MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34f93e7508b3e524b4a13746a05ad33724dbc8c4de2820d0bcea1dd76b59f1eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34f93e7508b3e524b4a13746a05ad33724dbc8c4de2820d0bcea1dd76b59f1eb
SHA3-384 hash: b558043c20ae92bd37abcc486c57693a0e0fbb3a296b1eec9f565dcde2870c7ffe8443acf3dbc1fed7d715fd9965728b
SHA1 hash: daef0be507a11a712c72f76ad57ce2c8ba1461e8
MD5 hash: dd4049165718236b77df11e4443e9cb0
humanhash: yankee-lion-william-purple
File name:dd4049165718236b77df11e4443e9cb0.exe
Download: download sample
File size:826'880 bytes
First seen:2022-04-17 13:36:52 UTC
Last seen:2022-04-17 14:44:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:EgjjHrDDa+VEPMnJGcJQFrO1OeehPl/Y5b42B3Zd:NDLa+yP4G6QFCdQW58AX
Threatray 647 similar samples on MalwareBazaar
TLSH T163050221F3A81B99D16257F59838815013B7B31BA53CC68A2DBA78CF6633BC21153F67
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
310
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/264195/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.25966.27679.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/625c180deab80a7a6c2f4cd8/reports/3f2a80bd-bbb0-45fc-84ef-543a78dcf180/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d17e65d3-dc90-4ad9-9152-85ff3cb32c1f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/977884
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34f93e7508b3e524b4a13746a05ad33724dbc8c4de2820d0bcea1dd76b59f1eb/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-17 13:37:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
023938b0dd03eba6e0b9b40eb2245290a0068dca585a01f72e3a374e064a958a
49a19077ef760fe9b149db0a5dc267d338d5b41064a2f8f89773e3a94bb7bc1e
4ea32ccd68ea4437adbb5639bbbd2a0098107f16b851ac463a136ec5ecba796a
546af5248d01e7d2b994944e9dd69ce8de7259515b898f1b8d1f6d811c62b1cc
7dc5190b4a5ceb3a78d1af98d29f6445518a059c957636160e7fd420713dfc7a
aabde47c768f6eb7dae47ceb456bc03636bd9802f3c160c0006def633e1dcf6c
c04232a1b72332d8a6189e0d7cd36d6bdd3c88a51b89bb14847f4325786ac484
dbac3948a35ae44b1e43093d34888baf8f759ce2c5a6316bab07f9944c395112
+ 637 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220417-qwth2sehhj/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
90ade9f40ab9c852bf1eb99d9390c95b1113d5b8a3f3b231bd3c7e8ac3537fe1
MD5 hash:
0123c9a82f5ea8d5b3acf7701cbaa9ec
SHA1 hash:
e96f07d23d3277be9b036c2cc69a8de263626dc0
Link:
https://www.unpac.me/results/b16b572a-d8fc-4b92-a011-cf78d1a7358b/
SH256 hash:
e5bcf795f2b367f7596e6024c2983766c0fa3c5710d58881971ebdb8154dfd7d
MD5 hash:
8c55cc5c773cfb593a7f937482ee2930
SHA1 hash:
2bffd9684b64195e919225e4fafa3a83d59e3269
Link:
https://www.unpac.me/results/b16b572a-d8fc-4b92-a011-cf78d1a7358b/
SH256 hash:
34f93e7508b3e524b4a13746a05ad33724dbc8c4de2820d0bcea1dd76b59f1eb
MD5 hash:
dd4049165718236b77df11e4443e9cb0
SHA1 hash:
daef0be507a11a712c72f76ad57ce2c8ba1461e8
Link:
https://www.unpac.me/results/b16b572a-d8fc-4b92-a011-cf78d1a7358b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/34f93e7508b3e524b4a13746a05ad33724dbc8c4de2820d0bcea1dd76b59f1eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 34f93e7508b3e524b4a13746a05ad33724dbc8c4de2820d0bcea1dd76b59f1eb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2141591/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/264195/

Comments