MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 363755d7a78e52ae1314c7c4a485048269a9680e93bc4cb82098ca6139bfd912. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 363755d7a78e52ae1314c7c4a485048269a9680e93bc4cb82098ca6139bfd912 |
|---|---|
| SHA3-384 hash: | a5353c1e824a2eb86f946c0588b69245035c82dc6711c28a48d69c9dda9ca78e70bac4e59cad810989ccaac5a0604287 |
| SHA1 hash: | 5987d740d6a5c770a38740185538ebab2390f950 |
| MD5 hash: | 1f579fbfea4243d9585586c39913d0ab |
| humanhash: | green-oklahoma-louisiana-hot |
| File name: | PerfectTube.cmd |
| Download: | download sample |
| File size: | 548'864 bytes |
| First seen: | 2020-08-18 11:45:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 849887af87d3c5a3505d23d8b15e02ce |
| ssdeep | 12288:fuv+XyDHRqUaF46A9jmP/uhu/yMS08CkntxYR5:Gv0wHRdfmP/UDMS08Ckn3Q |
| Threatray | 556 similar samples on MalwareBazaar |
| TLSH | B1C49D13EB20B11EE953C4B16C65826E1A197EB60295AE07BFC59F0934726D3B9F031F |
| Reporter |  abuse_ch |
| Tags: | cmd |
abuse_ch
Malspam distributing unidentified malware:HELO: pro.mxout.rediffmailpro.com
Sending IP: 119.252.152.28
From: Perfect Tubes Ltd <deepak.naik@perfecttubes.com>
Subject: We Have Remitted Your Invoice Payment
Attachment: PerfectTube.zip (contains "PerfectTube.cmd")
Intelligence
File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Running batch commands
Creating a process with a hidden window
Creating a file
Searching for the window
Deleting a recently created file
Replacing files
Sending a UDP request
Threat name:
Win32.PUA.Bitrepeyp
Status:
Malicious
First seen:
2020-08-18 01:37:16 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
1/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 546 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 363755d7a78e52ae1314c7c4a485048269a9680e93bc4cb82098ca6139bfd912
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.