MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 40afa1e323be151d0d7a38c72f771b0b9e909f49ddade942d4260a5e29e5ec2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 40afa1e323be151d0d7a38c72f771b0b9e909f49ddade942d4260a5e29e5ec2f |
|---|---|
| SHA3-384 hash: | ecaf321a11fe6da83facc7a978976a44e730a60a3cb547134ba42e113a785c5e0e081a869cbcb35c8733f9cece8ea2a7 |
| SHA1 hash: | a7161c8aa8da519759613145cdc086484de32df5 |
| MD5 hash: | 974317f8408b77933354de7a175f3ad5 |
| humanhash: | east-saturn-alaska-oven |
| File name: | 974317f8408b77933354de7a175f3ad5.exe |
| Download: | download sample |
| File size: | 282'220 bytes |
| First seen: | 2021-02-27 06:51:04 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4d17be67c8d0394c5c1b8e725359ed89 (5 x Adware.Generic, 4 x njrat, 3 x NanoCore) |
| ssdeep | 6144:CRqJ4hy0JeShiY5lfAWRmhmoOrtJ1DNFbSvx8x0RYL:todJeST9Umn3Uvx8ORYL |
| Threatray | 413 similar samples on MalwareBazaar |
| TLSH | 3754018A7590EAE7C1450A328A7146B8EF7F5B2F1D6A2B2F931C1D5B1C73106510FF2A |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Sending a UDP request
Enabling the 'hidden' option for files in the %temp% directory
Creating a file
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Deleting a recently created file
Reading critical registry keys
Replacing files
Running batch commands
Creating a window
Launching a process
Launching the process to change network settings
Moving a recently created file
Sending an HTTP GET request
Enabling the 'hidden' option for recently created files
Creating a process with a hidden window
Searching for the window
Unauthorized injection to a recently created process
Stealing user critical data
Launching a tool to kill processes
Sending an HTTP GET request to an infection source
Result
Threat name:
StormKitty
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Binary contains a suspicious time stamp
Contains functionality to log keystrokes (.Net Source)
Downloads files with wrong headers with respect to MIME Content-Type
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
May check the online IP address of the machine
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Posts data to a JPG file (protocol mismatch)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Capture Wi-Fi password
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal WLAN passwords
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Uses the Telegram API (likely for C&C communication)
Yara detected StormKitty Stealer
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-02-27 04:17:00 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 403 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
spyware
Behaviour
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops desktop.ini file(s)
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
a56508a041a5b5870578d9f5a1db6ec7186a74a50b391bd6506e9b62022bdf2e
MD5 hash:
198d38f9365499a5b3d62682b6c5afec
SHA1 hash:
cdeb1cbfafdeef9749f5994608f454e04ce6e6b3
SH256 hash:
00818933dfd4df43baffa3a119db981848415ca60a5e9e34184da64001fa72da
MD5 hash:
76b03c5fb5f3ac357211d0cee3e72291
SHA1 hash:
8a4d0384fe6db8a4e7186ed5ad9215edb09365da
SH256 hash:
fc58db92b69fc17bbce2c1dccdfa5bffa3abeadf6b6b188ed0f930ea3d3e637b
MD5 hash:
8dc06e7ad18391c1390fdea6891ea7db
SHA1 hash:
185f9e991544115a65d729f12a68deeccc442bd3
SH256 hash:
b0eb259851ec526818f7ea6789e81c418622a062d3ad314faa109f9ca3b1e0d9
MD5 hash:
8ae1fb5855778a77fdef9363ced09a0a
SHA1 hash:
76f0d6c4aba568ea0b8d7e18e898d4e0c15ddb25
SH256 hash:
40afa1e323be151d0d7a38c72f771b0b9e909f49ddade942d4260a5e29e5ec2f
MD5 hash:
974317f8408b77933354de7a175f3ad5
SHA1 hash:
a7161c8aa8da519759613145cdc086484de32df5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 40afa1e323be151d0d7a38c72f771b0b9e909f49ddade942d4260a5e29e5ec2f
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.