MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae0d3dbeab58e9b9b68ab6087eb5b30ace6f8892af4a85034f77ae3592271e42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae0d3dbeab58e9b9b68ab6087eb5b30ace6f8892af4a85034f77ae3592271e42
SHA3-384 hash: 812d7ce7f4206d57d109e6d08bc8912150569899a2b2ead611ef5376c3a5c2e607ead67ee32129d204d8e6f72ac8e435
SHA1 hash: 95d4a85c88773d0f43505008f2c62aabd6a53641
MD5 hash: 4a49bf0c4ca6766f040f25bcb1b6a33f
humanhash: march-virginia-table-florida
File name:ae0d3dbeab58e9b9b68ab6087eb5b30ace6f8892af4a85034f77ae3592271e42
Download: download sample
File size:248'907 bytes
First seen:2020-06-10 12:30:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 09d0478591d4f788cb3e5ea416c25237 (3 x Blackmoon, 2 x Gh0stRAT, 2 x TeamBot)
ssdeep 6144:ECO7j9bOSjVBGPOwnlYt0BlljrxuCGbnl8ZSGrl:ECIhlKPmKBHj8CInqx
Threatray 125 similar samples on MalwareBazaar
TLSH C5342260CE76B09EE9E10E3629F3B6194F55BFDB0023077B0DA606CD5BCD29141AEE06
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PECompact-2
Create hunting rule

PUA.Win.Packer.PecompactHeuris-1
Create hunting rule

PUA.Win.Packer.Pecompact-72
Create hunting rule

PUA.Win.Packer.Pecompact-74
Create hunting rule

PUA.Win.Packer.Pecompact-75
Create hunting rule

PUA.Win.Packer.Pecompact-69
Create hunting rule

Win.Trojan.Agent-1386987
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2012-11-05 00:43:00 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
118185aed4dd97bbf3fe28bebb075a67ca7dbf75dee24efa999e170ee13d0396
1ec347934db2ded3a012479882732bfb3cdc85b0d4b2911e3402c1fa693a2235
371b9214f60a70c81ec1756d284e8028ff7603498341ecb7fa5cc09f3b10043e
4544ada7458cad0c5a467b9bff1ac1a25f959e35c41a04298738195f93d7899a
51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1
b7f6102de87c99e03f47ea0b642f265cdf584316ac3e02733d42c3b17603a22c
cf813a86d30ddd0c2ca59f73334fffd241bfd31eddfe30dc2e73d5b29ae752d1
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19
fcce249643f7fe240695fdbc393b54a543fa4a49942b56ad8aad6f219c4f896d
ff92eb5433354ad51ba6c586ed91e8b69f32271b0d523352c87f8ae4d075151b
+ 115 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-3gxe47hbg2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments