MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3e71e3cd25afc388b26a1f2c24b3dc9810476fd015fffca1da584b4f98438d2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 3e71e3cd25afc388b26a1f2c24b3dc9810476fd015fffca1da584b4f98438d2f |
|---|---|
| SHA3-384 hash: | 7a975d510d294383eee24a979a2c441bf3b6169e16a5f3fb0048dca4f9dc4ef3f14f08f8f23d7ea77963a50b0bc94bb9 |
| SHA1 hash: | b91a782553de810ce26bec6aaa7780ab0a729ff1 |
| MD5 hash: | f395a01d904fc03098a26bea1e84111f |
| humanhash: | nuts-east-hotel-zulu |
| File name: | 168726655815eef30c6670d40d3dc1f56247396b33fe35af8aa4c9dde8b89cd08d9b40f594470.dat-decoded |
| Download: | download sample |
| File size: | 3'247'104 bytes |
| First seen: | 2023-06-20 13:09:21 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT) |
| ssdeep | 49152:O/lXB+9MnW6mg//Q13/XYjC742n/76JHPETVjLi6rd:ClRsXPYjC74S7aHPETNWQd |
| Threatray | 18 similar samples on MalwareBazaar |
| TLSH | T18AE5AD5AB696DE67E3D8BB3AA05351288731C2223326BB1F1F7D11753D933B409423DA |
| TrID | 80.3% (.DLL) Generic .NET DLL/Assembly (236632/4/32) 4.4% (.SCR) Windows screen saver (13097/50/3) 3.5% (.EXE) Win64 Executable (generic) (10523/12/4) 3.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) |
| Reporter |  abuse_ch |
| Tags: | base64-decoded dll |
Intelligence
File Origin
# of uploads :
1
# of downloads :
283
Origin country :
DEVendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Zusy.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Sigma detected: Execute DLL with spoofed extension
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Zusy
Status:
Malicious
First seen:
2023-06-20 13:10:06 UTC
File Type:
PE (.Net Dll)
Extracted files:
4
AV detection:
4 of 37 (10.81%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 8 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
3e71e3cd25afc388b26a1f2c24b3dc9810476fd015fffca1da584b4f98438d2f
MD5 hash:
f395a01d904fc03098a26bea1e84111f
SHA1 hash:
b91a782553de810ce26bec6aaa7780ab0a729ff1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
15eef30c6670d40d3dc1f56247396b33fe35af8aa4c9dde8b89cd08d9b40f594
dll 3e71e3cd25afc388b26a1f2c24b3dc9810476fd015fffca1da584b4f98438d2f
(this sample)
Dropped by
SHA256 15eef30c6670d40d3dc1f56247396b33fe35af8aa4c9dde8b89cd08d9b40f594
Dropped by
MD5 3694a0b798a58034743604673f68eb8e
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.