MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3f299a38f6196d2df259cd0b626e204fb81f5d33de5ec78d4bd7bae131ccb9d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 3f299a38f6196d2df259cd0b626e204fb81f5d33de5ec78d4bd7bae131ccb9d4 |
|---|---|
| SHA3-384 hash: | 38a7205790998057eddb653862a85e0352d2ddf4bea32f4399444a5b28d94e2febe977638f9373184e9ed281eda8c8c3 |
| SHA1 hash: | 3ffa6c671ce32d5818cd6f552145652eeb4ab410 |
| MD5 hash: | 19d22f176eec093d2ce313e3e0def5b7 |
| humanhash: | bulldog-autumn-alaska-grey |
| File name: | 19d22f176eec093d2ce313e3e0def5b7 |
| Download: | download sample |
| File size: | 2'146'789 bytes |
| First seen: | 2021-07-06 07:16:59 UTC |
| Last seen: | 2021-07-06 07:50:42 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5a594319a0d69dbc452e748bcf05892e (21 x ParallaxRAT, 20 x Gh0stRAT, 15 x NetSupport) |
| ssdeep | 49152:9qe3f6R5G57Y7ZI8vFKqIZC1ncC/vGW07cDq:MSiR5G5kNvFfjnre |
| Threatray | 24 similar samples on MalwareBazaar |
| TLSH | 8FA5CF3BB368E53EC4AA0B3245B39350597BBA65B81ACC1E47F0090DCF265E11E3B657 |
| Reporter |  zbetcheckin |
| Tags: | 32 exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
19d22f176eec093d2ce313e3e0def5b7
Verdict:
Suspicious activity
Analysis date:
2021-07-06 07:19:10 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
troj.spyw.evad
Score:
32 / 100
Signature
Creates files with lurking names (e.g. Crack.exe)
Multi AV Scanner detection for submitted file
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Sample is not signed and drops a device driver
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Generic
Status:
Suspicious
First seen:
2021-07-05 01:03:00 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 14 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery spyware stealer
Behaviour
Script User-Agent
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
a7e37f5314834b163fa21557e61c13c0f202fd64d3c0e46e6c90d2d02e033aec
MD5 hash:
6faec01bf7a3d7f5c5dee2e6e3143a58
SHA1 hash:
603a36f817cab5574e58ab279379e5c112e5fb37
SH256 hash:
3a1f7819402704397072699b5e46fe67b262d636d997d49564c1e8d9dfb70fd7
MD5 hash:
d5bb32ba40606f3287fb36c9a3458465
SHA1 hash:
4cebada14015d8ff11fea8c3ed71928dfa3190d2
SH256 hash:
3f299a38f6196d2df259cd0b626e204fb81f5d33de5ec78d4bd7bae131ccb9d4
MD5 hash:
19d22f176eec093d2ce313e3e0def5b7
SHA1 hash:
3ffa6c671ce32d5818cd6f552145652eeb4ab410
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 3f299a38f6196d2df259cd0b626e204fb81f5d33de5ec78d4bd7bae131ccb9d4
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxps://shadow-vpn.com/download/ShadowVPN.exe