MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcac2b958896388c7643ba8cb9a9d4c4150f67077eb7f8410d36b22cef7ed147. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcac2b958896388c7643ba8cb9a9d4c4150f67077eb7f8410d36b22cef7ed147
SHA3-384 hash: ce9f92bbbeaf9ef8fe95aa1b12d494f7da136010015f6ce036e30191209ee809974457c6a6447b9e8183178285d4edb4
SHA1 hash: dd671689e2e48796049967c4c20962f1371250a9
MD5 hash: 5ed365cf390f5a442cb34db8c13c6d72
humanhash: fillet-alaska-artist-ohio
File name:5ed365cf390f5a442cb34db8c13c6d72.exe
Download: download sample
File size:91'648 bytes
First seen:2021-03-01 19:11:35 UTC
Last seen:2021-03-01 20:36:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a50e815adb2cfe3e58d388c791946db8 (2 x njrat, 2 x DCRat, 1 x Lucifer)
ssdeep 1536:cyHDl2OJ83qbmMPyHK93s7/Wax4QAdy3VYjvESt1C9dTa0OnUQs7UU/u1nsewwqz:cyHDcg8aCMKHKls7uaxIyFhGC9xa0Ons
Threatray 296 similar samples on MalwareBazaar
TLSH 67930229E974E677E5D7DFF504E99241CBD4A4060F9F09A3350CB32B86B2657FB8002A
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5ed365cf390f5a442cb34db8c13c6d72.exe
Verdict:
Malicious activity
Analysis date:
2021-03-01 19:18:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e5757c90-863e-4bc4-917a-5bcf42b4a3db

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/120394/
Detection(s):
PUA.Win.Packer.ArjSfx-1
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching a process
Using the Windows Management Instrumentation requests
Searching for the window
Sending a UDP request
Deleting a recently created file
Launching the process to interact with network services
Launching a tool to kill processes
Deleting of the original file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/622781
Signature
Antivirus / Scanner detection for submitted sample
Disables security and backup related services
Machine Learning detection for sample
Sigma detected: Kill multiple process
Sigma detected: Stop multiple services
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 360381 Sample: VrecBPdRy4.exe Startdate: 01/03/2021 Architecture: WINDOWS Score: 76 53 Antivirus / Scanner detection for submitted sample 2->53 55 Sigma detected: Stop multiple services 2->55 57 Sigma detected: Kill multiple process 2->57 59 3 other signatures 2->59 9 VrecBPdRy4.exe 8 2->9         started        process3 file4 49 C:\Users\user\AppData\Local\Temp\...\4819.bat, ASCII 9->49 dropped 12 cmd.exe 1 9->12         started        process5 signatures6 61 Disables security and backup related services 12->61 15 cmd.exe 1 12->15         started        18 cmd.exe 1 12->18         started        20 cmd.exe 1 12->20         started        22 8 other processes 12->22 process7 dnsIp8 63 Disables security and backup related services 15->63 37 2 other processes 15->37 25 net.exe 1 18->25         started        27 net.exe 1 18->27         started        29 conhost.exe 18->29         started        39 5 other processes 20->39 51 3.0.0.0 AMAZON-02US United States 22->51 31 net.exe 1 22->31         started        33 taskkill.exe 1 22->33         started        35 taskkill.exe 1 22->35         started        41 10 other processes 22->41 signatures9 process10 process11 43 net1.exe 1 25->43         started        45 net1.exe 27->45         started        47 net1.exe 1 31->47         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fcac2b958896388c7643ba8cb9a9d4c4150f67077eb7f8410d36b22cef7ed147/
Threat name:
Win32.Trojan.Stosek
Create hunting rule
Status:
Malicious
First seen:
2021-03-01 19:12:09 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2555c6b4e0ce36a2851a552bfdea36410360e55a877ff6028458b14088062c37
290404d235fcb1fd5f5656a2d4b755416100c005f27f7f7fcbed7dfcdb9c2a2b
585dbee4540fb6bf72116be77c1902ef1c1a716a70b491b674f72bfae3db2569
98fd41a11788741d3e9f41d27b24f1d22d8f1bd81f52cc1619a6442f7355afae
9eb1cd61e77d7133bd5252c9c7574d4171ba60c856dbedd15754c5b0e3c827b4
a7b022be326a3aa380e1bd55bde21fea8d7e0c59e037b7db2902c63b01bb6fda
a97663c4fdf7f3cdf524888ec2952bb015e77484d50627e185e67c8846bd8660
bd23c3a3d5215798a115525fe15803ee5f4393ae77d49e081770761beecb14ea
c4284c413395930a3ca9561d55045bb40c5d14d8c70e44f4f7a9b944ef34935c
ffc615fe2397c96d4e4dc621481d1a37b62da5cf4ff3c7ba8c734725417f3f2b
+ 286 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion upx
Link:
https://tria.ge/reports/210301-46g6zpd5zx/
Behaviour
Discovers systems in the same network
Kills process with taskkill
Runs net.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Launches sc.exe
Modifies service settings
Stops running service(s)
Unpacked files
SH256 hash:
ff12dc56d1872b1c963aa4bc81a52c675e0373aa4308725251f9a9f6405b91f0
MD5 hash:
1df709ef09d3be54125502133770ea99
SHA1 hash:
95176b67397b6f994df4cc99e7dc8b99fec3e690
Link:
https://www.unpac.me/results/69fbd7ad-c5ea-47c8-837d-771963428573/
SH256 hash:
fcac2b958896388c7643ba8cb9a9d4c4150f67077eb7f8410d36b22cef7ed147
MD5 hash:
5ed365cf390f5a442cb34db8c13c6d72
SHA1 hash:
dd671689e2e48796049967c4c20962f1371250a9
Link:
https://www.unpac.me/results/69fbd7ad-c5ea-47c8-837d-771963428573/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fcac2b958896388c7643ba8cb9a9d4c4150f67077eb7f8410d36b22cef7ed147

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:upx_packed
Create hunting rule
Description:UPX packed file

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe fcac2b958896388c7643ba8cb9a9d4c4150f67077eb7f8410d36b22cef7ed147

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1037323/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/120394/

Comments