MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3e8debf82b69f5842a21c7bbaf83071c7944f257843d31aad36664dc9e951fff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 3e8debf82b69f5842a21c7bbaf83071c7944f257843d31aad36664dc9e951fff |
|---|---|
| SHA3-384 hash: | 753b7f3bca74fe9b419f7a122b77e6f57f4fabc5ba852aa59c832e5b3e9140460ae5c406b6aa8323fde6389312bf0a21 |
| SHA1 hash: | 15ff8e274065cfe9de9267f2df2f02b8b96ca296 |
| MD5 hash: | 69274d186c71ec9face040105a968ae2 |
| humanhash: | moon-equal-robert-undress |
| File name: | BTC Transaction details 11_01_2021.exe |
| Download: | download sample |
| File size: | 2'210'816 bytes |
| First seen: | 2021-01-11 08:17:34 UTC |
| Last seen: | 2021-01-11 09:30:11 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'307 x AgentTesla, 20'722 x Formbook, 12'402 x SnakeKeylogger) |
| ssdeep | 24576:HR1jM3ntVKgNjhgrKl9sMjBc2dgmziuSDHQ191S+k5ARnitV:x1Y3ntVKg71l9+/4wH2cDAB |
| Threatray | 117 similar samples on MalwareBazaar |
| TLSH | 84A5F9067BC5D599C9D1B53A97F9837C03B2E9E751009BA352047AB5DE322C23C3E1EA |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
BTC Transaction details 11_01_2021.exe
Verdict:
Malicious activity
Analysis date:
2021-01-11 08:32:50 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
adwa.evad
Score:
72 / 100
Signature
Creates multiple autostart registry keys
Drops PE files to the startup folder
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-01-11 08:18:08 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 107 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
persistence
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Unpacked files
SH256 hash:
3e8debf82b69f5842a21c7bbaf83071c7944f257843d31aad36664dc9e951fff
MD5 hash:
69274d186c71ec9face040105a968ae2
SHA1 hash:
15ff8e274065cfe9de9267f2df2f02b8b96ca296
SH256 hash:
49dc26861fffee2f6440e56a10b7086ea305d2f16bb9e27ba3e08b9893557f86
MD5 hash:
e732cd6decfed3503b4020899d5a56f9
SHA1 hash:
024c1bf147c698e92aae340bbee323601d02a787
SH256 hash:
d2d27f59b366c1ae5cd71ffce1f9c9475e1d2ec10f56bc040f3c5af0934f0e15
MD5 hash:
520367a5fb4f7081458386091047bf2b
SHA1 hash:
2706693fc04deed174314099d8d6ca5e30577351
SH256 hash:
c06d4e3d0205d9bdd4a4b40b8da710d698b3a5d73a1626c9ca058c10b2c6d00c
MD5 hash:
7f67414b3fd29299f2d29ad7c2afb995
SHA1 hash:
2ec40d57c08c47433a6d044d271d74005dddae8d
SH256 hash:
4f81e273da20c5b9835ce6ca57cc061d77764f9e3927bdb1505cb791bf50b046
MD5 hash:
29e19b5dce96140a8b90152b16bd44af
SHA1 hash:
4f3dc6eb876bb58f53966980a9c451a04ec17d8a
SH256 hash:
e2b5646e959fcf2f6ed994780262e65c16cecbc9d3421ada3239f26130ebe8d1
MD5 hash:
7a13d5b7628956f87cb4f24b3e66ff5d
SHA1 hash:
5a2a3e4a70a7ef67180b6dea2273c9c3ae162f9c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 3e8debf82b69f5842a21c7bbaf83071c7944f257843d31aad36664dc9e951fff
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.