MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 55af8940100b432c2873c1b4ec0068516ec9459ae313fd1d3ac2957ef7abe033. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 13
| SHA256 hash: | 55af8940100b432c2873c1b4ec0068516ec9459ae313fd1d3ac2957ef7abe033 |
|---|---|
| SHA3-384 hash: | d4c5877e1863a4890f136615d6bc68b86ce6fed083da6a79ab150b4665c731f23f0bcce1e90091f5defcc47260ca94c6 |
| SHA1 hash: | 7870a26f33469c4cef96cecd4e0b20c82fa4e1af |
| MD5 hash: | 96cbbd2930425374e0d2d6e251be9834 |
| humanhash: | five-xray-item-nineteen |
| File name: | 96cbbd2930425374e0d2d6e251be9834.exe |
| Download: | download sample |
| File size: | 6'231'483 bytes |
| First seen: | 2022-11-06 17:05:12 UTC |
| Last seen: | 2022-11-06 19:04:00 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki) |
| ssdeep | 98304:UJlQcZOWdS58SUxTzskoHi3a7UpYLzwnGuqfkIF8RK2qBHNp6mgC6ZwECQ0em5v8:UJltOuS54xTzs5XTLFBfkJ42qBtpJ2wU |
| Threatray | 6'505 similar samples on MalwareBazaar |
| TLSH | T12456336901790D8BF70B727314293D7F83E71A9F24A9EE5967446ECF3A53190ECB90A0 |
| TrID | 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
https://bit.ly/3F3uhJA
Verdict:
Malicious activity
Analysis date:
2022-11-06 12:46:23 UTC
Tags:
trojan rat redline loader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Launching a process
Creating a process with a hidden window
Sending an HTTP GET request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Deletes itself after installation
Encrypted powershell cmdline option found
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential dropper URLs found in powershell memory
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Phonzy
Status:
Malicious
First seen:
2022-11-06 15:35:08 UTC
File Type:
PE (Exe)
Extracted files:
142
AV detection:
13 of 26 (50.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 6'495 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
9/10
Tags:
evasion upx vmprotect
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Executes dropped EXE
Modifies Windows Firewall
UPX packed file
VMProtect packed file
ACProtect 1.3x - 1.4x DLL software
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
df66573cd34dc477aac8a06185f0519143c403766dc93492fccd29a2a7e5e7be
MD5 hash:
93918bca8e219f9b65d1fe304afc2428
SHA1 hash:
c4b39df748384c906abae86003f35db6ec75369f
SH256 hash:
8f79940660b88b13bc727cb5ddbb69a7fe5c9512030a977c052578e1940103b4
MD5 hash:
106d8ffe658f771aa4699f95a30197ec
SHA1 hash:
7fb907dc8ce2e9e812d693bf99a609b3de5cbf5e
SH256 hash:
0b2277d8aaf36e01aca3ae33e227b44bebc541a9c5cef6eb4fef93e96821a6cd
MD5 hash:
b1ba7a8263281244782ca5604876cb2c
SHA1 hash:
b8523dee6d7e74512a05c60cc35c0fddac370252
SH256 hash:
55af8940100b432c2873c1b4ec0068516ec9459ae313fd1d3ac2957ef7abe033
MD5 hash:
96cbbd2930425374e0d2d6e251be9834
SHA1 hash:
7870a26f33469c4cef96cecd4e0b20c82fa4e1af
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 55af8940100b432c2873c1b4ec0068516ec9459ae313fd1d3ac2957ef7abe033
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.