MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcaf7a2e9cc327d8186c5d450c4780d466d8d809d2969d1363239e6632a90534. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcaf7a2e9cc327d8186c5d450c4780d466d8d809d2969d1363239e6632a90534
SHA3-384 hash: f7b3b028fdcaebe4fa6d175a2e76a7f4f7f3c096063c0a3489a21b909fad62d34eef9315c227204a47f6b58f71e18652
SHA1 hash: b6bfcb788eb52f0bc7dea9b729a27e48dcf56002
MD5 hash: b392113c9a9bf97417bd6243c8bb68fa
humanhash: oregon-kitten-orange-batman
File name:b392113c9a9bf97417bd6243c8bb68fa.dll
Download: download sample
File size:31'744 bytes
First seen:2021-09-10 14:15:01 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 384:o/xz4b37x2kBD67HxfHjaL5P4FKd0A1qrFcwae+LRp6hPknh:Tx2kg7lD4F0KdscBQPch
Threatray 154 similar samples on MalwareBazaar
TLSH T1F8E24F0B56CE7EE6C4B81670773393C1DB2CDE044953EA2E4AE4B625D93E203B9523D9
dhash icon 414545c0d4c05503 (37 x njrat, 3 x AsyncRAT, 1 x RedLineStealer)
Reporter abuse_ch
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/186905/
Detection(s):
Win.Trojan.Bulz-9889421-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f0804b73-8ea0-41e3-b498-475ba181333e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/848836
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 481265 Sample: jaEjmUcNz6.dll Startdate: 10/09/2021 Architecture: WINDOWS Score: 48 13 Multi AV Scanner detection for submitted file 2->13 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        process5 11 rundll32.exe 9->11         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fcaf7a2e9cc327d8186c5d450c4780d466d8d809d2969d1363239e6632a90534/
Threat name:
ByteCode-MSIL.Trojan.InjectorX
Create hunting rule
Status:
Malicious
First seen:
2021-09-10 13:38:11 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
013e28fb236b074fae60d3252c602924a886ad4c311310dbb19f85ba1c5e2425
454d76ef9b357985c651a1c636cd7a07c680c4e42e2856e54659fb38d5e2532c
4e0d95ed4e6390e06c4dd40425dcd4988c74effd08a7ed0ae577491ac3e3c655
5adb192079fbc16f4631d3e5c894d9bec1ed384e7be85742c4f076760eb64a0f
75830575168e1d024a8d0c86764cb9b88eea3c79f0c4a24fb39d4e94fd2c42d7
a7f68c540c7f610ce1127b997f3097815b0dbbdb6dd9a7d4637f4059a7af26f4
c1911013a12f40b0a1f344eec88f2fba5a5f505335feec6c0a54a6e23cb66564
dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa
e924821860bcee2dd1acc0239f6413cd6a677213b640942d271ea12446fc65aa
f06267d67c638007d2b6381cee8a98d6a5e4259e185c945b66e110d37f0fed26
+ 144 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210910-rkkmfadcfr/
Unpacked files
SH256 hash:
fcaf7a2e9cc327d8186c5d450c4780d466d8d809d2969d1363239e6632a90534
MD5 hash:
b392113c9a9bf97417bd6243c8bb68fa
SHA1 hash:
b6bfcb788eb52f0bc7dea9b729a27e48dcf56002
Link:
https://www.unpac.me/results/0b1542f9-86b9-43d6-ba76-a4f6f5a8c500/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/fcaf7a2e9cc327d8186c5d450c4780d466d8d809d2969d1363239e6632a90534

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DLL dll fcaf7a2e9cc327d8186c5d450c4780d466d8d809d2969d1363239e6632a90534

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/186905/
  
URLhaus
https://urlhaus.abuse.ch/url/1608120/
  
Delivery method
Distributed via web download

Comments