MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 142aed1e29eb66a9f81ab29ef88d3b6a038f60b731d3ecab2771ee6575214b7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 142aed1e29eb66a9f81ab29ef88d3b6a038f60b731d3ecab2771ee6575214b7f
SHA3-384 hash: 1301983d961d685373b237a0e4a62eb73afd3af70b80a5299f27e96b207e356aadece741c63e092e7c026756c482efb9
SHA1 hash: 1bdee42822d746184e2490c2515cc17984a57690
MD5 hash: 3ccb9335eccc7a07f14cd1c6bae37093
humanhash: saturn-vegan-zebra-rugby
File name:936e545013cbb1c65af31b6c5f89527c
Download: download sample
File size:212'992 bytes
First seen:2020-11-17 12:24:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 03ae0108c7455c49c94d2d60afa1e57a (1 x Worm.Ramnit)
ssdeep 3072:mbq+/AcAA/a1xRwIqI23drshWCysdmPr4p0/+aCxyHlj4pLthEjQT6j:jmGRw82gWCysd2Dm3xOjkEj1
Threatray 73 similar samples on MalwareBazaar
TLSH A5248E4076A2C58BE4EF1776A4F0A9D70BB47C50DBF2915BB8A53B9F19B7B040900B93
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Razy-9759519-0
Create hunting rule

Win.Malware.Zusy-9759529-0
Create hunting rule

Win.Trojan.Agent-1381405
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the Windows subdirectories
Running batch commands
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Creating a process from a recently created file
Creating a file
Result
Verdict:
0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/539397
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file has a writeable .text section
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 318796 Sample: 936e545013cbb1c65af31b6c5f8... Startdate: 17/11/2020 Architecture: WINDOWS Score: 72 59 Antivirus / Scanner detection for submitted sample 2->59 61 Machine Learning detection for sample 2->61 63 PE file has a writeable .text section 2->63 12 936e545013cbb1c65af31b6c5f89527c.exe 3 2->12         started        process3 file4 51 C:\Windows\SystembehaviorgraphAE.exe, PE32 12->51 dropped 53 C:\Windows\SystembehaviorgraphAE.exe.bat, ASCII 12->53 dropped 15 cmd.exe 1 12->15         started        17 WerFault.exe 23 9 12->17         started        process5 process6 19 GAE.exe 3 15->19         started        23 conhost.exe 15->23         started        file7 47 C:\Windows\UJVKRZ.exe, PE32 19->47 dropped 49 C:\Windows\UJVKRZ.exe.bat, ASCII 19->49 dropped 67 Antivirus detection for dropped file 19->67 69 Machine Learning detection for dropped file 19->69 71 Drops executables to the windows directory (C:\Windows) and starts them 19->71 25 cmd.exe 1 19->25         started        27 WerFault.exe 19 9 19->27         started        signatures8 process9 process10 29 UJVKRZ.exe 3 25->29         started        33 conhost.exe 25->33         started        file11 55 C:\Windows\System\JIC.exe, PE32 29->55 dropped 57 C:\Windows\System\JIC.exe.bat, ASCII 29->57 dropped 77 Antivirus detection for dropped file 29->77 79 Machine Learning detection for dropped file 29->79 81 Drops executables to the windows directory (C:\Windows) and starts them 29->81 35 cmd.exe 1 29->35         started        38 WerFault.exe 29->38         started        signatures12 process13 signatures14 65 Drops executables to the windows directory (C:\Windows) and starts them 35->65 40 JIC.exe 35->40         started        43 conhost.exe 35->43         started        process15 signatures16 73 Antivirus detection for dropped file 40->73 75 Machine Learning detection for dropped file 40->75 45 WerFault.exe 40->45         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/142aed1e29eb66a9f81ab29ef88d3b6a038f60b731d3ecab2771ee6575214b7f/
Threat name:
Win32.Trojan.Aenjaris
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:30:45 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0442d6172e1b01552d3120027e608f0c813389a9c7276399f53e0b051288f4d0
088fb74bd478543cca2e9746a1f86f84cefbc5876137c09bbe53e6f3e79fda9c
2c1e6769208a36e6f5751565dd448673275c2a703aedeef144e49b7789cc9d95
2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1
324187c87edf4d100fd962f026828b0d838505120db40430fe471242f4b1522a
347cb099e70226ad94dd881735ef3939a47b8bbcd2316cc1aa4a6678a7702867
9dc9e84417abae2d03346b9855469e751126477b52412bf9eff8f7aa09bb35ab
9f69e4209459877bfd78e5de12c2d736ac04142c1ec1ddb94a38bc91a8e97a02
b07f8a3235234b38405b57fe41af7c8f89c46b091cc0b3cb8670cb5337d7b4fa
f0e9d1f4d3c8bceb62949372616ab9cba3345e691b440e3c94e11e2f8808a823
+ 63 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-e5bzaqwc8s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Program crash
Drops file in Windows directory
Executes dropped EXE
ServiceHost packer
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
142aed1e29eb66a9f81ab29ef88d3b6a038f60b731d3ecab2771ee6575214b7f
MD5 hash:
3ccb9335eccc7a07f14cd1c6bae37093
SHA1 hash:
1bdee42822d746184e2490c2515cc17984a57690
Link:
https://www.unpac.me/results/dccf7659-f182-4026-94be-531836cea50a/
SH256 hash:
00cb93ce386a050226878d1fada2f18625a7bceba379eca7e1219bdde2a21acd
MD5 hash:
6ad85d60ce2af0b9aa8f7c84f4361eb5
SHA1 hash:
3eca51c32048c7c4e86f56d581ab30b1bc1d938e
Link:
https://www.unpac.me/results/dccf7659-f182-4026-94be-531836cea50a/
SH256 hash:
f498150c8f34fe62b210a58d95165919fcce7a3856fec350e81dbf730bd3bc64
MD5 hash:
c83816b25761c5f51c13fd238fde019d
SHA1 hash:
05bc35c6e293d08546c9f6cfd5f6f17fc4fbc1da
Link:
https://www.unpac.me/results/dccf7659-f182-4026-94be-531836cea50a/
SH256 hash:
0ab931373dd7454b493a4e131d9993831d6ed561774b8ac0344b85ab28021d57
MD5 hash:
54dd4f8792cb0b0b33198a096c01858d
SHA1 hash:
d0f94a5ed745986bfd184e4b1862ccb9759f7dc8
Link:
https://www.unpac.me/results/dccf7659-f182-4026-94be-531836cea50a/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments