MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3f5f718eea347bd327c4e7b525d0fc1ce91d54d4b1e4da1e78e18a35f19756e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 3f5f718eea347bd327c4e7b525d0fc1ce91d54d4b1e4da1e78e18a35f19756e3 |
|---|---|
| SHA3-384 hash: | c7b3c376fffb07cbf11b57b44875d474f2f8a42d1b2c7b34c2238a376d79f75fd3d0e51bf1a30db725b4f009f4f2a026 |
| SHA1 hash: | bc42169c1f0a32c7e3187699c86b45cda47597b5 |
| MD5 hash: | e8e4b35395b0d282e4d88e169f0da56f |
| humanhash: | utah-one-uncle-william |
| File name: | e8e4b35395b0d282e4d88e169f0da56f.exe |
| Download: | download sample |
| File size: | 4'164'608 bytes |
| First seen: | 2021-01-01 18:02:25 UTC |
| Last seen: | 2021-01-01 19:58:48 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 98304:emWi8d2BG15PMnzFwrj+Nl7X5CH7E0XB6Ze/IzG:emR8d2BG15YxwryNl7X5CbE6ImS |
| Threatray | 65 similar samples on MalwareBazaar |
| TLSH | BF16232236348BB5C53713F7E102446143B57E1B762DE27BA9C2BCDB38A2B524426D9F |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e8e4b35395b0d282e4d88e169f0da56f.exe
Verdict:
Malicious activity
Analysis date:
2021-01-01 18:02:55 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Contains functionality to hide a thread from the debugger
Contains functionality to inject code into remote processes
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Generic
Status:
Suspicious
First seen:
2020-12-25 22:49:50 UTC
AV detection:
8 of 29 (27.59%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 55 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
3f5f718eea347bd327c4e7b525d0fc1ce91d54d4b1e4da1e78e18a35f19756e3
MD5 hash:
e8e4b35395b0d282e4d88e169f0da56f
SHA1 hash:
bc42169c1f0a32c7e3187699c86b45cda47597b5
SH256 hash:
0f256359406c1ea7669c1d1aef5fb3e959f3907ae4cd5cba421c8a0f84aa2bf9
MD5 hash:
332292005633baf54f86231c3e781876
SHA1 hash:
738078cde3461cd07488758f1d6ada0f23487096
SH256 hash:
aadd19a3a2fd1bc502e1e8f8cacc77fdba44a1d4c60eb648c0c01e9c7c010346
MD5 hash:
1cf0de5f777420e9d4bd4b0fbd8e68ee
SHA1 hash:
c2e848061bcc27a21c403b25e7d5ef3fef96efef
SH256 hash:
e83cef9cfa4e2ea30e28843e43c60ebf8f6590fb753ad0aa5ed1123c01280527
MD5 hash:
bf99ee5fbf42797bd1ade95b109d634c
SHA1 hash:
e02abfdbca94a24a36b47d49a28360b79aabd294
SH256 hash:
29a62f5fc3ffb297c48af0ff38e3fa323d6f857431880681eb41bffb8543dea8
MD5 hash:
4b8a1ae41beb73ca88134cbbe897afac
SHA1 hash:
2d7d287f37ac2132316832796bc78b58598666a0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.