MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 12ca4693f082107b4979a7d1ee7c880c1318b0813f3ba766dd1a52634a37738f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | 12ca4693f082107b4979a7d1ee7c880c1318b0813f3ba766dd1a52634a37738f |
|---|---|
| SHA3-384 hash: | 2ae673b03164ac1aff6593cd9b4851166d59f1faa260214dd66b2106849fade4aeb65c1629aeb592e30326723923cfe0 |
| SHA1 hash: | 1b4cbf9e586f1a982b10fe2abd3d15980ccaebff |
| MD5 hash: | 65308084d64617a296f61bfc5b425bcf |
| humanhash: | berlin-friend-zulu-lemon |
| File name: | 65308084d64617a296f61bfc5b425bcf.exe |
| Download: | download sample |
| File size: | 4'553'216 bytes |
| First seen: | 2022-03-03 09:39:39 UTC |
| Last seen: | 2022-03-23 04:43:40 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7dc28ef949f54ad98c715895ecc34cff (79 x RedLineStealer, 2 x Formbook) |
| ssdeep | 98304:IAZ0ZkXrYXaot7QPzv5HTiEHpW4o6qwfH+rlOzN0uCv6HC6Fghj:IA8Xaot7QPzxuEg45H+rlENHCqbgx |
| Threatray | 1'507 similar samples on MalwareBazaar |
| TLSH | T1DB26331721AAEB0CC51567F32317BD16EED503FD80E4C19CEA0A1946E96EEB016987FC |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
3
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Fragtor
Status:
Malicious
First seen:
2022-02-16 09:28:27 UTC
File Type:
PE (Exe)
AV detection:
34 of 42 (80.95%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 1'497 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
n/a
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
98c821fb279473f2e320b99fd1e1dcdc7769fba77856a236e774783fe222e382
MD5 hash:
3eaf0368e27116021a650a5376f09679
SHA1 hash:
c01c210569cf93028b4ff8d83e39aee2b49b7993
SH256 hash:
12ca4693f082107b4979a7d1ee7c880c1318b0813f3ba766dd1a52634a37738f
MD5 hash:
65308084d64617a296f61bfc5b425bcf
SHA1 hash:
1b4cbf9e586f1a982b10fe2abd3d15980ccaebff
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 12ca4693f082107b4979a7d1ee7c880c1318b0813f3ba766dd1a52634a37738f
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.