MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 582a065ea88a6240e88f101004a754ecc4b82d4ee43f76938c0b4081a9e08f2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 582a065ea88a6240e88f101004a754ecc4b82d4ee43f76938c0b4081a9e08f2e
SHA3-384 hash: 3c2e00ea5ccd2d698235dbcd72098c9f483cb682d93a3325b8c16de69e01f9890af003492b2761c356cd2ef6a1670452
SHA1 hash: 6272d85069d27a47ed0a73a708e6b54e44a90a33
MD5 hash: 977380bebab9c4663ef5d060b33e07d3
humanhash: colorado-london-carolina-pennsylvania
File name:582a065ea88a6240e88f101004a754ecc4b82d4ee43f76938c0b4081a9e08f2e
Download: download sample
File size:1'022'976 bytes
First seen:2020-07-06 06:39:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:Fia2MAaTK8TIw0dbHxYc0l979oe60V/yLHaT2z5tXOFPRCQ:t2MAaOw0dbHxV0lzon0Uaqz5teFP8Q
Threatray 420 similar samples on MalwareBazaar
TLSH C52501DC762172EFC897D0728EA86C68FA50607B832F5213D41756EDDA0C99BDF184B2
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
Win.Packed.Ursu-7748951-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Connection attempt
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/582a065ea88a6240e88f101004a754ecc4b82d4ee43f76938c0b4081a9e08f2e/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 23:02:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
12859bb50366c248e9488a8852c0923bcb4135f8fcedcbac19228fe329ff39a7
17c38ccce635b7567fb09e4e48c53b5661bdd29e827917a447f0de7741694d71
25babc8d9be2e6cc3cdd408fac70bea0d9c3f0c3480945d3bcb374c88b6f82c1
3e9cb7d6eaaa8c07d939eca0bbfd2d670e349de2dd018c8d30ab59b5e19ddc95
56f27a73c491313639665758a863f1d00871d0b37077a03bfd5d50a4689d273d
682be0853ccd6f60deb69d27941a628758c4e13e7d2e6ee95a95f415f3a9f0c6
847b3580cba59e7f4b453488c263544f3c481027d2ddf4f9f3988d84afc35c85
a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b
c8cc7c1a1210a082960b929c3598521979e16c1c6f5626b8ad29b9618ab5e18c
d0d47f1c08031d4297f713a98d6ca969009df8c0f637110622190d4ff9727106
+ 410 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200706-vmfdvrgpv2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/20877/

Comments