MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22a19734326aad3f8a2321db66c0a5c992665391b6b43da3764ae440ee41305f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments 1

SHA256 hash:	22a19734326aad3f8a2321db66c0a5c992665391b6b43da3764ae440ee41305f
SHA3-384 hash:	85f22de688b9714ab99fed8a9601dad1585d7893f6fab2c1e0f794fb594616ea88b39fe351a6a9cd705a4170f655b919
SHA1 hash:	2537d1c83362ca0c6fc78ee21fac75b763766d9e
MD5 hash:	6bf7f7e0c20e4154dfd0a9500136e0ca
humanhash:	vegan-network-oxygen-hamper
File name:	6bf7f7e0c20e4154dfd0a9500136e0ca
Download:	download sample
File size:	26'112 bytes
First seen:	2022-08-22 12:41:23 UTC
Last seen:	2022-08-22 13:35:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'751 x AgentTesla, 19'657 x Formbook, 12'248 x SnakeKeylogger)
ssdeep	384:rQQ/dEM3FnK4aFc/QiLpPcnoyYX6ooOA:8Q/dECFnSc/gvYKoV
Threatray	1'173 similar samples on MalwareBazaar
TLSH	T1D7C2C61752CEBEE2C9B91670777343C1D72DEE009853DA2E5AE0752AD97E2033A523D8
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	414545c0d4c05503 (37 x njrat, 3 x AsyncRAT, 1 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe

Intelligence

File Origin

# of uploads :

# of downloads :

240

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

6bf7f7e0c20e4154dfd0a9500136e0ca

Verdict:

Suspicious activity

Analysis date:

2022-08-22 12:43:32 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/1132c80e-2183-4737-952a-b953091512bf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/300214/

Detection(s):

SecuriteInfo.com.W32.AIDetectNet.01.30788.30473.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/630379a2393b1c8c4703f304/reports/65c9f6e3-1f72-4b53-a44f-f5d46d8731f6/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/8bca921b-7fe7-435b-8067-2e58c19c81f0

Result

Threat name:

Unknown

Detection:

suspicious

Classification:

n/a

Score:

24 / 100

Link:

https://www.joesandbox.com/analysis/1055506

Signature

Machine Learning detection for sample

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/22a19734326aad3f8a2321db66c0a5c992665391b6b43da3764ae440ee41305f/

Threat name:

ByteCode-MSIL.Trojan.Generic

Status:

Suspicious

First seen:

2022-08-22 12:42:10 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

9 of 26 (34.62%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ekqzonbsnkwt7crdehnwnqffzgjgmu4rw22d3i3wjlseb3sbgbpq._file

Verdict:

unknown

27a5e7226e99dfd6f1940565c19e61efcf4047085693b2c8c46e5ce843c1e943

be510101fc17c2f329cffd071b2498c46e05273e1f80b93c3e87308da0cb99c7

+ 1'163 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220822-pxb5qaagg9/

Unpacked files

SH256 hash:

22a19734326aad3f8a2321db66c0a5c992665391b6b43da3764ae440ee41305f

MD5 hash:

6bf7f7e0c20e4154dfd0a9500136e0ca

SHA1 hash:

2537d1c83362ca0c6fc78ee21fac75b763766d9e

Link:

https://www.unpac.me/results/80f61024-0d18-4e9a-93c0-c37c1a87b5fb/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/22a19734326aad3f8a2321db66c0a5c992665391b6b43da3764ae440ee41305f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.