MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd945e2cc6d1b3a453135d5df04eeccbfd16f76e0744dd27b99e0eccaa9053bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HiddenTear


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd945e2cc6d1b3a453135d5df04eeccbfd16f76e0744dd27b99e0eccaa9053bd
SHA3-384 hash: b04d4b6f8eb3a7d349e89c18e5c55a4b2e71a4d0e720cbfa7475a63dbb5a922da9769d63542fe18145cb80e69d8099e1
SHA1 hash: c227ca088a4f80729b83396cafa0152d9778254e
MD5 hash: 900c456cbcd61ed2bf91378112e93eb0
humanhash: bulldog-tango-snake-delaware
File name:software-launcher.bin
Download: download sample
Signature HiddenTear
Create hunting rule
File size:212'480 bytes
First seen:2020-09-02 10:11:55 UTC
Last seen:2020-11-05 12:52:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:sQv80czaLtgFM+lmsolAIrRuw+mqv9j1MWLQj87B38vkIJUUxzqkbppqYaUoE:R00lq++lDAA37BzUxW0pA+
Threatray 1 similar samples on MalwareBazaar
TLSH 232475E07784C065E8B79AB9987BE9A36823BA1E9C58540D3891FF0F3D733424427D5B
Reporter JAMESWT_WT
Tags:HiddenTear

Intelligence

File Origin
# of uploads :
2
# of downloads :
2'020
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ispy
Create hunting rule
Link:
https://www.capesandbox.com/analysis/54288/
Detection(s):
SecuriteInfo.com.Trojan.EncoderNET.HiddenTear.1.14918.32305.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Changing a file
Reading critical registry keys
Modifying an executable file
DNS request
Sending a custom TCP request
Creating a file
Stealing user critical data
Encrypting user's files
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/457332
Signature
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd945e2cc6d1b3a453135d5df04eeccbfd16f76e0744dd27b99e0eccaa9053bd/
Threat name:
ByteCode-MSIL.Ransomware.HiddenTears
Create hunting rule
Status:
Malicious
First seen:
2020-09-01 21:53:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7wkf4lgg2gz2iuytlvo7atxmzp6rn53oa5cn2j5ztyhmzkuqko6q._file
Verdict:
malicious
Similar samples:
66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955
HiddenTear
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/200902-tppprxxxp2/
Behaviour
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Filecoder
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd945e2cc6d1b3a453135d5df04eeccbfd16f76e0744dd27b99e0eccaa9053bd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/54288/

Comments