MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3fba18cd0da590c6e176aad69b89f3cec04f0f5dccf9a5d9788b5b9321269198. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | 3fba18cd0da590c6e176aad69b89f3cec04f0f5dccf9a5d9788b5b9321269198 |
|---|---|
| SHA3-384 hash: | 55ab04339a8ca65c2d22b2a1afbdd00aaaf6ebc619e45b16901d125ab0b1fe7d5ea953a509d29278300ac4b3c5f00786 |
| SHA1 hash: | 15c6c43bf12de3e90f01f922e27eb69392f562c4 |
| MD5 hash: | a09750dcaf8657f1b10856fc7c163c53 |
| humanhash: | pennsylvania-shade-mountain-double |
| File name: | a09750dcaf8657f1b10856fc7c163c53 |
| Download: | download sample |
| File size: | 212'992 bytes |
| First seen: | 2020-11-17 12:03:57 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 03ae0108c7455c49c94d2d60afa1e57a (1 x Worm.Ramnit) |
| ssdeep | 3072:TBlZ9qwUEtTsxWV+/aa+xNV0lwh+UsenUJ5wltmbR7qLrbbRF/mh9mFCy4pLthEB:TBlZ9qQOCIH+J0/95MA9MbzOgFkEj1 |
| Threatray | 121 similar samples on MalwareBazaar |
| TLSH | 6A248C0A72A7E092DDD703354DF1DBA819D1FD139A6342DB7A86378F18B26050EC6BE1 |
| Reporter |  seifreed |
Intelligence
File Origin
# of uploads :
1
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Creating a file in the Windows directory
Running batch commands
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Threat name:
Win32.Trojan.Aenjaris
Status:
Malicious
First seen:
2020-11-08 10:40:05 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 111 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Program crash
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
ServiceHost packer
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
3fba18cd0da590c6e176aad69b89f3cec04f0f5dccf9a5d9788b5b9321269198
MD5 hash:
a09750dcaf8657f1b10856fc7c163c53
SHA1 hash:
15c6c43bf12de3e90f01f922e27eb69392f562c4
SH256 hash:
e6e573aab9f3f7cd261d1960f5c6a5ff57c62bd1d9e3c59d4317b03c9745d5f2
MD5 hash:
7662f9f4bcc96de09e90423cb00b313e
SHA1 hash:
9c5ff71290c4c1463758671a1d1edec322e9c635
SH256 hash:
05c3147d645ab2297c809687d737acf76661cfda81d835b79eaae76d561c35ce
MD5 hash:
ab10d0dc3508094cfc9cb49dc4e2daab
SHA1 hash:
fc8b4694dce84c8399b84a087fc9f7c945e142e8
SH256 hash:
8e9497b39d6bcdbe5de194268ca224ef5adf767f508ca65fdc80ad2e6a6e0caa
MD5 hash:
197d6503b2ae80520992863db4126203
SHA1 hash:
3129f83b288c07874f91eed12290d6a8b2c32b32
SH256 hash:
32c39e0e8127305a5675ce8e578ab5fe9ec2147ea82c886b65560a7213421958
MD5 hash:
643d51f46ffcde5eba0da196d55aa12e
SHA1 hash:
c99838f9908456970e8529a2b5dbe13892d5e9bd
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.