MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107
SHA3-384 hash:	29ad3161c8248407647fdbfcd0608ea9cab49f9a8a628c703110d671b0a7b13fa4334b0e068aafee3e6bfb49fbe5aa24
SHA1 hash:	3a4ed8e57d02c8312147b13b6153ec50dc0258a8
MD5 hash:	02c5dc235a3815ae32649ec6dec8b63d
humanhash:	island-mirror-pluto-edward
File name:	SecuriteInfo.com.W32.Agent.NNJU-2136.19553.21244
Download:	download sample
File size:	275'379 bytes
First seen:	2023-12-13 15:21:28 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	deba71fcd4e68e93af678f2a5e291977
ssdeep	3072:0HDp7pRuKjsir5HZFQGrsUwF7hplPoutjgVp25skQ4qu/m1qocmjHwJ0fQh8cP:+RR5rhZFQGrsUwF7vlPoSM0Ou8JcUQ9P
TLSH	T18844391A3DF4E873C00B4A318CB766BCB661B8614D428F4B26D6D71DEC3A1916E22D77
TrID	25.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 24.7% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 15.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.1% (.SCR) Windows screen saver (13097/50/3) 6.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter	SecuriteInfoCom
Tags:	dll

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

308

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/467279/

ClamAV Detected

Detection(s):

SecuriteInfo.com.W32.Agent.NNJU-2136.19553.21244.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

89%

Tags:

control hook keylogger lolbin overlay packed packed packed shell32 upx

Link:

https://www.filescan.io/uploads/6579cc39da3178d99ce3e3a7/reports/454cd188-7aac-43d8-9097-b125a4dd3030/overview

Hybrid Analysis Win/malicious_confidence_90%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Generic Malware

Malware family:

Generic Malware

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/eb17ebbe-af78-4d0e-b726-f3527a7183ed

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

n/a

Score:

27 / 100

Link:

https://www.joesandbox.com/analysis/1361562

Signature

Machine Learning detection for sample

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fn43isypkm62xzgqrtak5witsal6z4sxcwl6zall3756rlvfsedq._file

Threatray unknown

Verdict:

unknown

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

upx

Link:

https://tria.ge/reports/231213-srynbagba3/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

UPX packed file

UnpacMe 2

Unpacked files

SH256 hash:

810aca5e424f1ab273494089476d0783fa6d676339da286fb06dc4a09aa55a8c

MD5 hash:

6e6f3d1804a8531b0636ad7cb555fa47

SHA1 hash:

967957d7ea1fc522de8a8f4575ab6a60272cc6d1

Link:

https://www.unpac.me/results/c68b40c9-a602-44b2-8006-a112847be5fb/

SH256 hash:

2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107

MD5 hash:

02c5dc235a3815ae32649ec6dec8b63d

SHA1 hash:

3a4ed8e57d02c8312147b13b6153ec50dc0258a8

Link:

https://www.unpac.me/results/c68b40c9-a602-44b2-8006-a112847be5fb/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.59

Link:

https://yomi.yoroi.company/submissions/2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/467279/