MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36696f58a4cddf15123f607d294af671ef7d82c5c05339d352b10861ac0df3b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36696f58a4cddf15123f607d294af671ef7d82c5c05339d352b10861ac0df3b7
SHA3-384 hash: cb610f89a307f59177e9e70cc9e697a80c4963fcb64216e63dc12f7d8948e7186f9c8003023c2a46d3031f9f3eff2693
SHA1 hash: f9efbb8287e985081ec4f8ffeee0b0a052d9df39
MD5 hash: 2e93f6569f3697170775ed5d05cefd32
humanhash: snake-steak-paris-kansas
File name:2e93f6569f3697170775ed5d05cefd32.exe
Download: download sample
File size:66'560 bytes
First seen:2022-02-12 19:56:41 UTC
Last seen:2022-02-12 21:51:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 384:uq3xa7m0MctrvB7R7+E836JozM0tmfHS7LP13wXcSASU5eIY2LHZ/6Zn:1/0MgF1g6JLfyHPBwXcJ3+IHpA
Threatray 395 similar samples on MalwareBazaar
TLSH T1035342F08FF9B9A4E0152077B8A4B53C37C79E0EDC559436E65BF24A34629C260E5E0B
File icon (PE):PE icon
dhash icon 00414f4f4f4f4700 (14 x CoinMiner, 12 x RedLineStealer, 12 x NodeLoader)
Reporter abuse_ch
Tags:exe


Avatar
abuse_ch
Payload URL:
http://74.201.28.62/book/packageinstall1202202234.png

Intelligence

File Origin
# of uploads :
2
# of downloads :
314
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/241099/
Detection(s):
SecuriteInfo.com.Trojan-Downloader.MSIL.Seraph.pef.15828.15676.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending an HTTP GET request
DNS request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6208111245ddfa2e18c552d3/reports/9dc036a1-6323-4edb-9d4b-741f69aec9db/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/33c47194-4af1-4269-9124-9422950072ad
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/938847
Signature
Antivirus detection for URL or domain
Deletes itself after installation
Encrypted powershell cmdline option found
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Sigma detected: Suspicious Encoded PowerShell Command Line
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36696f58a4cddf15123f607d294af671ef7d82c5c05339d352b10861ac0df3b7/
Threat name:
ByteCode-MSIL.Trojan.AgentAGen
Create hunting rule
Status:
Malicious
First seen:
2022-02-12 19:57:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
245f10bd87db63dab02528af1be27f84be2be58aee091227a3c3b5c4373f08b9
2ed1c5c2c50af3c2502d8e55d5f1f7fb85bbb570c3e1a587902741d5ce4338c5
48a5f1539d03b94078fea1485945c8a896efd01f0ccfdc6a7298f0f663639b32
5259d3f0c53ee6e30c1977ab414ec2a5fafcf34ebeb3faf781f12e44a7d88200
97ef0b6753b493e34d415f0b6a89241dec5566cf59f3f18f2ab2a961c3876fba
abc5f306aae4ed8a42216e5b16b14b312eac674877724fe3b9beb56b8e6cfb47
ad6cbb7939f8824d2e2d503673cddd9fd04afe0f17b73565c357cfc9b08098e0
b100e4e89f9793a97ece1f3a91b2ef8c7c060c7e5685f6769651d54b06b986a3
c679ae237789f035c9a6ee6f04eba66d5169ea42106c78a6cccee8b394aa15c5
+ 385 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220212-yn88jadah7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Checks computer location settings
Deletes itself
Unpacked files
SH256 hash:
36696f58a4cddf15123f607d294af671ef7d82c5c05339d352b10861ac0df3b7
MD5 hash:
2e93f6569f3697170775ed5d05cefd32
SHA1 hash:
f9efbb8287e985081ec4f8ffeee0b0a052d9df39
Link:
https://www.unpac.me/results/e41c0460-6767-4663-8a5e-25f5aaace1c8/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/36696f58a4cd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exec_macros
Create hunting rule
Author:ddvvmmzz
Description:exec macros
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/url/2041784/
Cape
Cape
https://www.capesandbox.com/analysis/241099/

Comments