MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 56af437f8b3b60b32b7cba77fa159138a777a48e98ce0215e8ec6f97ef12b223. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | 56af437f8b3b60b32b7cba77fa159138a777a48e98ce0215e8ec6f97ef12b223 |
|---|---|
| SHA3-384 hash: | bd59c5f8e3c2210755fc472d09f304d330dc094580a49974d03ca0d5b4a8f109fd01afaafd37b4547f64534b7a3375cd |
| SHA1 hash: | 87752254bed5574957f3e483168f2829a44f4a97 |
| MD5 hash: | abe4a1c3959eb4847079c9b4ebb6d807 |
| humanhash: | oranges-tennis-robin-mockingbird |
| File name: | SecuriteInfo.com.Variant.Strictor.234398.8512.12300 |
| Download: | download sample |
| File size: | 6'251'520 bytes |
| First seen: | 2020-06-19 02:32:41 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader) |
| ssdeep | 98304:suBHlsy/rKc58p7YPRxMldWDyN90cSaPPRRnHozpbSZfZKeVO0GOKJwf3waH96id:suwRc5aeRK+oHSaxRHKstZKe40GBJwfz |
| Threatray | 15 similar samples on MalwareBazaar |
| TLSH | 495633169BE1112EF1F91F30BDB1478117BEBCD68CBAA0AF1256DABD093391085B471B |
| Reporter |  SecuriteInfoCom |
Intelligence
File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Strictor
Status:
Malicious
First seen:
2020-03-10 22:18:47 UTC
AV detection:
9 of 31 (29.03%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 5 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
persistence evasion spyware trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Adds Run entry to start application
Modifies system certificate store
Reads user/profile data of web browsers
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 56af437f8b3b60b32b7cba77fa159138a777a48e98ce0215e8ec6f97ef12b223
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.