MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38e4561a82de707558afe87d6dea895aba160758375e3ded20aa3fd2b5f40be7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments 1

SHA256 hash:	38e4561a82de707558afe87d6dea895aba160758375e3ded20aa3fd2b5f40be7
SHA3-384 hash:	baa31a659332ab703e22bf1324214c16da34831e7676023f48e3405f305e6de6db99472a4c3bcc30fb11a3e18e06f8b0
SHA1 hash:	2019d9b9a88c7b333890096253814927195b0546
MD5 hash:	3640289c895c4d2529feb63fee349763
humanhash:	sixteen-early-florida-skylark
File name:	3640289c895c4d2529feb63fee349763
Download:	download sample
File size:	30'208 bytes
First seen:	2022-09-11 07:41:06 UTC
Last seen:	2022-09-11 10:04:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	384:dfoH1/tte/5+UGIGszZfEJLdT4aFckxrn00KPwda8OH0O:GH1FH7s1cJLdpckl1OHL
Threatray	908 similar samples on MalwareBazaar
TLSH	T1EFD22C2752CEBEE6C9B91A70377343C1D76DDE049403CA2E5AD4712A997E2037E827D8
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	414545c0d4c05503 (37 x njrat, 3 x AsyncRAT, 1 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe

Intelligence

File Origin

# of uploads :

# of downloads :

343

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

3640289c895c4d2529feb63fee349763

Verdict:

No threats detected

Analysis date:

2022-09-11 07:42:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2dfedb48-aed8-41e4-9134-b2e200590e68

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/309262/

Detection(s):

SecuriteInfo.com.Variant.Lazy.226312.19203.17788.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Searching for the window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed shell32.dll stealer

Link:

https://www.filescan.io/uploads/631d918fa90642bcbbffcd27/reports/6524ad4a-9979-4397-add0-43b3d611f44b/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ccad0753-2824-4929-ac45-53747f430d22

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1068416

Signature

Antivirus detection for URL or domain

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Uses Windows timers to delay execution

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/38e4561a82de707558afe87d6dea895aba160758375e3ded20aa3fd2b5f40be7/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2022-09-08 00:43:14 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 26 (73.08%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hdsfmguc3zyhkwfp5b6w32ujlk5bmb2yg5pd33javi75fnpubptq._file

Verdict:

malicious

35356ffd06abd1c12e45c9ff69e768185117ee4a145c98f8fae00340bddbb5e9

64ffc251c77d71afabe72fc0f85a33673e69d2689b8346a772319fe678249583

69524564c4734188cc263c43e5abb9ebb895cb9bcc94d4483df8249a80ac97cc

7342f57f0fb094b1d1a7e68f1164ef14bd5a6d6c29ad4e01dd4158479e1ba87d

9115b821f251889ec675158dc52d6b8c17278107b1ed4c2c1b1adbbe9809cb60

d57aff27d214ead66ce125c84d42d15a044750db64b701ef202ef034661e6b2e

fc08885434f9b2677ca7076bc2651218335dfb40141fa7fe49558bd3c7eb4e5a

ff06c54cab0bdcb0cea8c47f5ef001b2fc917ba857a0d14308ab7211408ba608

+ 898 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220911-jjnzgabcb4/

Unpacked files

SH256 hash:

38e4561a82de707558afe87d6dea895aba160758375e3ded20aa3fd2b5f40be7

MD5 hash:

3640289c895c4d2529feb63fee349763

SHA1 hash:

2019d9b9a88c7b333890096253814927195b0546

Link:

https://www.unpac.me/results/3986b424-5250-490f-a650-84d84e88e2a1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/38e4561a82de707558afe87d6dea895aba160758375e3ded20aa3fd2b5f40be7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 38e4561a82de707558afe87d6dea895aba160758375e3ded20aa3fd2b5f40be7

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2299326/

Cape

https://www.capesandbox.com/analysis/309262/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-09-11 07:41:09 UTC

url : hxxp://81.161.229.110/htdocs/zMXSTtkQQSdDjHP.exe