MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffa4485b730b662d6c9e65a4e6b8687c3037838f582839821eefae481c327baf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffa4485b730b662d6c9e65a4e6b8687c3037838f582839821eefae481c327baf
SHA3-384 hash: 9d1d1a8da6cba15f5b6afd0e1381d17f7432e080695b18dd25282715e86d5d91c15f53a2d3179d6e7949c626e3d58f1e
SHA1 hash: 435383dd1baa4a01393ed8df38d708d4f88bd91a
MD5 hash: 7cf5b81c02503abd48c16121df1e4d60
humanhash: lithium-lima-saturn-victor
File name:Krnl_Bootstrapper.exe
Download: download sample
File size:1'881'088 bytes
First seen:2023-01-09 15:19:43 UTC
Last seen:2023-01-09 16:36:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash df9a7bc1c6c6cd97d04c3762fdde6719 (18 x CoinMiner, 2 x CoinMiner.XMRig, 1 x PripyatMiner)
ssdeep 49152:QQIu25g3oeEZM4kWEO8zhLtrMYTeyazTxLWnCzHf5Hp:QpebWEO8zJtlTeyOTI
Threatray 32 similar samples on MalwareBazaar
TLSH T141950163DA859864DCA0C7B90563CB7DC213BD642530865E18FEBCBBF7774812EA8472
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 7232928a92b37360
Reporter im7ap
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
177
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://cdn.discordapp.com/attachments/1061847383123689496/1061964172348358737/Krnl.zip
Verdict:
No threats detected
Analysis date:
2023-01-09 13:29:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/02b3ba45-862a-490f-b708-4bb4fe955b7b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/351201/
Detection(s):
SecuriteInfo.com.Win64.TrojanX-gen.22822.31413.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Launching a process
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Enabling autorun by creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/63bc30a5fc9525ae8a45134f/reports/926e819c-fbb9-4d93-91a5-5c9455ba37dd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/67e79b87-4726-4d07-8d6e-a55e1253b93b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1148093
Signature
Found hidden mapped module (file has been removed from disk)
Maps a DLL or memory area into another process
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 780832 Sample: Krnl_Bootstrapper.exe Startdate: 09/01/2023 Architecture: WINDOWS Score: 84 41 Multi AV Scanner detection for submitted file 2->41 7 updater.exe 1 2->7         started        11 cmd.exe 1 2->11         started        13 cmd.exe 1 2->13         started        15 5 other processes 2->15 process3 file4 37 C:\Users\user\AppData\Local\...\ftlsnytm.tmp, PE32+ 7->37 dropped 43 Multi AV Scanner detection for dropped file 7->43 45 Writes to foreign memory regions 7->45 47 Modifies the context of a thread in another process (thread injection) 7->47 55 2 other signatures 7->55 17 powershell.exe 7->17         started        19 conhost.exe 1 7->19         started        49 Uses powercfg.exe to modify the power settings 11->49 51 Modifies power options to not sleep / hibernate 11->51 21 conhost.exe 11->21         started        29 4 other processes 11->29 31 5 other processes 13->31 39 C:\Users\user\AppData\Roaming\...\updater.exe, PE32+ 15->39 dropped 53 Uses schtasks.exe or at.exe to add and modify task schedules 15->53 23 WMIC.exe 1 15->23         started        25 conhost.exe 15->25         started        27 conhost.exe 15->27         started        33 3 other processes 15->33 signatures5 process6 process7 35 conhost.exe 17->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ffa4485b730b662d6c9e65a4e6b8687c3037838f582839821eefae481c327baf/
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-01-09 08:52:05 UTC
File Type:
PE+ (Exe)
Extracted files:
3
AV detection:
20 of 26 (76.92%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=76seqw3tbntc23e6mwsonodipqydpa4plaudtaq656xeqhbspoxq._file
Verdict:
unknown
Similar samples:
09a3a72ed78683c5fbe62e66c33ba7d5dc8b77ca5f52965364e8d41d5622c29d
12f308243fe099acdb7718428e027aa77846efa6f18e6cf8235daaadcb46ed1f
4087249b32bc81f6df39a587acd55b0f0cf59a53d14f734a05886ff3e1bdaaa2
4b56d0b0c8c52803bf7c21587bd98a16f73f0d6ed4e4153eee1964533ac394ee
505a09c5be91d9e44a7b459ac5e8961fe01a234c1633a789ba290e94e81fa5f5
68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
7812b5f5fd710358255d8847f61729386cb982c55beb12a77e240d3377aaeafb
89a342bb20ad895c86665599e40ecd591b2993f5a1b343768dbb7af038aebd31
dd84819f9d2e108ac8dbbfedf10d61f787b6082f02ddb63ca05c98d78e877597
ef1cb9555d780addb510d052b41f070dbdeb931c3f916bf345a419a4d437a167
+ 22 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230109-sqrhlsef69/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/659b4531-19e6-4907-87fa-047b04ed8157
Unpacked files
SH256 hash:
ffa4485b730b662d6c9e65a4e6b8687c3037838f582839821eefae481c327baf
MD5 hash:
7cf5b81c02503abd48c16121df1e4d60
SHA1 hash:
435383dd1baa4a01393ed8df38d708d4f88bd91a
Link:
https://www.unpac.me/results/4b1b01fa-ab7c-4ffe-b30b-6969e2cf4063/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ffa4485b730b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ffa4485b730b662d6c9e65a4e6b8687c3037838f582839821eefae481c327baf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe ffa4485b730b662d6c9e65a4e6b8687c3037838f582839821eefae481c327baf

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/351201/

Comments