MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27d1e735572f83321a266037a5f451e145008e308d6278c63a6ef106e2d298a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27d1e735572f83321a266037a5f451e145008e308d6278c63a6ef106e2d298a5
SHA3-384 hash: 0b78d413e9e6833ad30b78ba38702830764d88668ae93c88a38ef2fad3b9fee6e2d910037000c000314b33691904cfb5
SHA1 hash: 9e676a3ef0e220b1e52ce039b4f6013274d3752f
MD5 hash: cbc4e35c6a76b4f093ba3d5f4fe38c45
humanhash: victor-mike-oxygen-pennsylvania
File name:SecuriteInfo.com.Trojan.PWS.Siggen2.46479.20836.5597
Download: download sample
File size:845'824 bytes
First seen:2020-04-08 10:49:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:c1Uc15NPJi1axhMbQ1pHKaMd5tg3X3KRQ4I7MTQ36GpP:SB30axe2KZu3dYI6G
Threatray 20 similar samples on MalwareBazaar
TLSH BD05125137F89B32D6BC47FE55B220040372E03A6912F30DAFD678EF2A627E05586667
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.46479.20836.5597.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-04-08 10:06:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
11d8da5aedad9fde99211e94796aba422762ee6943f359c313626faf2eb0638f
3ef781d62c1d2c6aab1f44ea337439553d249ff98a4b70ded2b21ce1cb39bba4
942040aa151db7981d1d09c3cf264df1ada08805011a4720812016bd231048a7
96b1ce824a3687c29b0cb8663c62a09545eb713a3dcf776c29c9a85a393e5d1c
97d23ffd00c0dd37730804366759beb11de41f3f5d245014e976a57d667a5ccd
9ba6343e794c0e415adb118885c33aa18446c746dd30ec59b4fda2724b2f08d7
ac3099876d3eff055dcd6d797ce8a59f5381a09e0b7b553e229230c19be5681e
b7f91e8b80d469bdd1ab452b999a839daff2bd5deb86d24d9a197e7a2941b604
eeff6ccf798f62c083d9ffb79d3807433c39cc153e85db8bab498d0c688af078
f22ea9b80af6dab15179a98494ece17216381d9b334c6bb2a130040eeafaf614
+ 10 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_blackremote_w0
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 27d1e735572f83321a266037a5f451e145008e308d6278c63a6ef106e2d298a5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/336658/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments