MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4fe62c19cbb43d22b3116e7d7d3fb26c3d5bdfbfc5731fc5bde238aea6e98572. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 4fe62c19cbb43d22b3116e7d7d3fb26c3d5bdfbfc5731fc5bde238aea6e98572 |
|---|---|
| SHA3-384 hash: | b759b0baa549435a5b53df414f4d00ffbdc660b0061f311ee591a2d819139eb0f8e3083d15274639328ac491f46a86d9 |
| SHA1 hash: | 891fa10c0e43e300aa155504e51d5d14021e5f43 |
| MD5 hash: | 140c9507813e636c2c3d497e7d5b7633 |
| humanhash: | yankee-crazy-jig-kilo |
| File name: | FfgvYUp3A8PluWu.exe |
| Download: | download sample |
| File size: | 824'320 bytes |
| First seen: | 2020-10-16 10:28:53 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'751 x AgentTesla, 19'657 x Formbook, 12'248 x SnakeKeylogger) |
| ssdeep | 12288:VseaUKpJ+MJGSwYRq706hSUXtEWQdjq46l2LbbnxZivxpVOhx+mB8x8:CLJPJbwYR2EWW6l2Lepc+m+x8 |
| Threatray | 37 similar samples on MalwareBazaar |
| TLSH | 4105ADABC6899ED7DB788CBD8005162214F6D773686EE2843DF0348076FD6CB4792D1A |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: server.zaretyqq.tk
Sending IP: 188.225.82.58
From: Raut Suraj (Sales Engineer) <sales@mla-sales.com>
Subject: PURCHASE ORDER
Attachment: PO.zip (contains "FfgvYUp3A8PluWu.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Malrep
Status:
Malicious
First seen:
2020-10-15 11:01:32 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 27 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
4fe62c19cbb43d22b3116e7d7d3fb26c3d5bdfbfc5731fc5bde238aea6e98572
MD5 hash:
140c9507813e636c2c3d497e7d5b7633
SHA1 hash:
891fa10c0e43e300aa155504e51d5d14021e5f43
SH256 hash:
01dd844990e0c5fdcea0f88712253aa1ef4750316f0734ab7099306170b5ea2a
MD5 hash:
eb593633270aa19162cf64663df9dd6c
SHA1 hash:
2ec57181471ff10abe9a04239ca3ea86ea4252b9
SH256 hash:
0bcc3cba87c97ff7f497861875ef728786feca8cd7efaa4b9f44ffc9a37b06bd
MD5 hash:
c15bff7bf54d504ad8a0cd2ca7164803
SHA1 hash:
85e4bac5f5acf89e58238d5d4e4a61f30ba88c84
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 4fe62c19cbb43d22b3116e7d7d3fb26c3d5bdfbfc5731fc5bde238aea6e98572
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.