MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f428cda5f99c3961bb5532cd38f6c512cffb2a6dfc30865897e52d838c7cfef2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f428cda5f99c3961bb5532cd38f6c512cffb2a6dfc30865897e52d838c7cfef2
SHA3-384 hash: e139ab784b556b941cdd9393feda2de01c4e58e73f8261eed125f582f28444848adfe963975d13dc7a4f7cca64042446
SHA1 hash: 9a54602c229bbffd147a052371425323ee4b84fd
MD5 hash: d00ecfd54e03540dab62fb2f20b9dcdd
humanhash: michigan-arizona-idaho-cardinal
File name:f428cda5f99c3961bb5532cd38f6c512cffb2a6dfc30865897e52d838c7cfef2
Download: download sample
File size:889'086 bytes
First seen:2020-06-03 09:30:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger)
ssdeep 12288:zYV6MorX7qzuC3QHO9FQVHPF51jgcH3DOkj/aOODtPPGbp0mIE5wXWMPWqNw3yTh:wBXu9HGaVHXDx/dmPPGbpeE5wT9ZvM0f
Threatray 1'107 similar samples on MalwareBazaar
TLSH 1F1512813BE68876C4F22331943A98E019317C60EEF4A35F6748F71E6431E96D86677B
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

Win.Malware.Generic-6961740-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Aitinject
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 04:29:30 UTC
AV detection:
39 of 48 (81.25%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
137b5dc137f3f0c5bc3d4e1cd1f2396b33bd5b87291f72013a98b319c130b451
2db7aa7291c73bde092cd4cc8af0aff7eac7245ae5b034d8bb8810c76d85cd91
3148f0c0266e7ec90e12a356b8a88a272f3dd4e88c7aa9db82da2788bd0dc2d5
36e5646b2622d4c47947fa54a8f35c1c9d91db60ce3116e352f9f93b8a9f3ada
4249d6f93c374bf9199c33bbc49f57c1d1dd983e8c6356b5ed8739d326683c77
5f829ed079ce3010fb99eca5ee356e2ffc5ab62cedfb2683ac5ac76a66fb3ed1
62e9a9522a98f1a4ad322c5ef52fa3187a1204df9455d57766e4b221dc56fd35
908959fae28ad03836fb12b94a9a2f80981ec15f6481c230b9108f097edeb176
9dc8d8533e87fe22f98fb67f8705e14e93a8eeb5da355dc15251e03837334162
d8c07fc0cc1addc3f25623ac872703d2c10ae5e8fadc7370e13b4162e063a376
+ 1'097 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201109-jdqwnazt62/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments