MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe1330ade7fc1f8722e4aeabe15b57c1ff3d18b483dd273fe1df7cef3e27f8bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe1330ade7fc1f8722e4aeabe15b57c1ff3d18b483dd273fe1df7cef3e27f8bf
SHA3-384 hash: a6e563a838415450dc6367f387b18d11eb00900d8523b8c1938e11a28b5a6b28e5206bdb57f04f74b5a7fd3b415c454f
SHA1 hash: 302b0bbf687fcc69ed4d1a8bd35f0501f41f457b
MD5 hash: d120d6db5e032cb0a1f71fac2080adc2
humanhash: whiskey-violet-cola-whiskey
File name:fe1330ade7fc1f8722e4aeabe15b57c1ff3d18b483dd273fe1df7cef3e27f8bf
Download: download sample
File size:364'032 bytes
First seen:2020-06-16 09:35:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a459954138cf2a762bc5e5f961bda8c9 (5 x BlackShades, 1 x BabylonRAT)
ssdeep 6144:0L1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19mF:0LdcfxaeM6fy/KaVUtgKkTZ73coNRJmF
Threatray 3 similar samples on MalwareBazaar
TLSH B374231349EA2647C9F799FC4901A5C84C3B082F14DDD769E7817EFB718BAA04584EE8
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
OlympicDestroyer
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10770/
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.MintZard
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 19:37:29 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc
6a18ff52d179fa32975ac72f36ae60abe5f7ac754e5ad616cbd375127b2904c6
91e6f72cd4a4721915609abef27afcb72f170739c51384332da3cb6a8bb8f150
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/200624-begla6mvq2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious behavior: GetForegroundWindowSpam
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10770/

Comments