MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0306e132e4dc643712efacee5db4e2c781b9ae221be63502d0af23ba27cc6f0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	0306e132e4dc643712efacee5db4e2c781b9ae221be63502d0af23ba27cc6f0f
SHA3-384 hash:	55c928de38e0f0356a847dd7d3751d2e401c272ddf0eefc732b70be11974b8dda1b87113d557bd009a9aebe0408dedea
SHA1 hash:	5ed0ea37751ffa1bd2654ca68c3efb37a7751599
MD5 hash:	6f5a58aea469d4e95eb995bbfb0434ff
humanhash:	rugby-kitten-low-july
File name:	SecuriteInfo.com.Trojan.GenericKD.61580113.23354.21528
Download:	download sample
File size:	26'112 bytes
First seen:	2022-08-30 15:45:44 UTC
Last seen:	2025-09-27 23:49:29 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	384:HgQ//5uMxXvq4H4aFc/QiLpPcsoyYIEo:AQ//AyXttc/gEYXo
Threatray	1'221 similar samples on MalwareBazaar
TLSH	T1E2C2D61352CEBDE6C9B806703B3343C1C32DEE149913DA2E5AE0752AD97E2477A527D8
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	414545c0d4c05503 (37 x njrat, 3 x AsyncRAT, 1 x RedLineStealer)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

252

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Trojan.GenericKD.61580113.23354.21528

Verdict:

No threats detected

Analysis date:

2022-08-30 15:48:44 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/6f149ba3-3706-41bc-878c-85b15b237b4c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/302601/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.61580113.23354.21528.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/630e31072fdf5a0825936b0b/reports/effc1304-2dad-4534-ac27-8bc731cb4993/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/08199869-5a14-4901-9f9f-321025f8ed88

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1060637

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0306e132e4dc643712efacee5db4e2c781b9ae221be63502d0af23ba27cc6f0f/

Threat name:

ByteCode-MSIL.Trojan.Generic

Status:

Suspicious

First seen:

2022-08-29 12:42:13 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=amdocmxe3rsdoexpvtxf3nhcy6a3tlrcdptdkawqv4r3uj6mn4hq._file

Verdict:

malicious

0f64d014d4d33662182bd077ac47d0e0f607ef604466b0c59ee42c9445a9512c

22a19734326aad3f8a2321db66c0a5c992665391b6b43da3764ae440ee41305f

27a5e7226e99dfd6f1940565c19e61efcf4047085693b2c8c46e5ce843c1e943

494741c67536496a1584b493d77e14cda4f192a2c5dd7b80620b1c2ba994085c

be510101fc17c2f329cffd071b2498c46e05273e1f80b93c3e87308da0cb99c7

e4825c5e3d7de5d4bf16efb2ee460a6992fbba375379d8677185636400a26f69

+ 1'211 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220830-s7l98acff7/

Unpacked files

SH256 hash:

0306e132e4dc643712efacee5db4e2c781b9ae221be63502d0af23ba27cc6f0f

MD5 hash:

6f5a58aea469d4e95eb995bbfb0434ff

SHA1 hash:

5ed0ea37751ffa1bd2654ca68c3efb37a7751599

Link:

https://www.unpac.me/results/2ce00ac4-c064-488b-90b2-e97605d920f7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/0306e132e4dc643712efacee5db4e2c781b9ae221be63502d0af23ba27cc6f0f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.