MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 272e64291748fa8be01109faa46c0ea919bf4baf4924177ea6ac2ee0574f1c1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | 272e64291748fa8be01109faa46c0ea919bf4baf4924177ea6ac2ee0574f1c1a |
|---|---|
| SHA3-384 hash: | 6d0be9f18ca2efaedef2872372388c3e60725e76872ebb9b261efbdd0017f9261b9ec17ef3ec8e1a17c9cc2d1f45fde1 |
| SHA1 hash: | 37b644ef5722709cd9024a372db4590916381976 |
| MD5 hash: | 7099a939fa30d939ccceb2f0597b19ed |
| humanhash: | jig-july-fish-ten |
| File name: | 11_keylogger.exe |
| Download: | download sample |
| File size: | 26'112 bytes |
| First seen: | 2020-03-24 14:36:09 UTC |
| Last seen: | 2021-02-02 15:11:53 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger) |
| ssdeep | 384:bmHJExna0Gnj/XWRxDs3LWYtVyQeGBe4jRrWfTGkLR7w4DJ6LNcJq8:aH3asVtVyQemjK0/O7 |
| Threatray | 116 similar samples on MalwareBazaar |
| TLSH | 71C24A09B7A98676DC7D5F390873272013B4EC525927EF6F0BE0719A29733508B83B96 |
| Reporter |  Racco42 |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
6
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw
Score:
60 / 100
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Mbt
Status:
Malicious
First seen:
2019-05-10 12:15:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
39 of 46 (84.78%)
Threat level:
2/5
Verdict:
unknown
Similar samples:
+ 106 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
js exe 272e64291748fa8be01109faa46c0ea919bf4baf4924177ea6ac2ee0574f1c1a
(this sample)
Delivery method
Other
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.