MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c3bde59fa48471670841beba658fc9cfe707fac64b4b7f8446dd51a7706d133. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 5c3bde59fa48471670841beba658fc9cfe707fac64b4b7f8446dd51a7706d133
SHA3-384 hash: 3a53e4755b2e021df3d95915baade4ea82320d6bbf4aba6f8a80d9ca9c4f505745ec36233598d2242dc7dd1514fd5cf8
SHA1 hash: 01e9ec2d7a136aff0a98842fa876588c564809a7
MD5 hash: d1a9338fc86ea88c1e8408d736ba13ec
humanhash: alaska-nevada-seven-lake
File name:uncategorized_2.2.0.0.vir
Download: download sample
Signature ZeuS
File size:288'448 bytes
First seen:2020-07-19 19:28:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c0d0d06686238c1c08462f928917728
ssdeep 6144:WrGWQHnD+jRjZwy0UZL6HAPbuvUNdQbcUZQFcOJ/A:Wr6ujZQUsAPiysZSA
TLSH 0754022931E28066E110087044D81FFA9FBFCA7326932A9FC734E9541EF57B6541B8EE
Reporter @tildedennis
Tags:uncategorized


Twitter
@tildedennis
uncategorized version 2.2.0.0

Intelligence


File Origin
# of uploads :
1
# of downloads :
20
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Reading critical registry keys
Creating a file
Deleting a recently created file
Reading Telegram data
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a TCP request to an infection source
Stealing user critical data
Threat name:
Win32.Trojan.Mint
Status:
Malicious
First seen:
2015-03-27 05:25:00 UTC
AV detection:
31 of 31 (100.00%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Behaviour
Modifies Internet Explorer settings
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Loads dropped DLL
Executes dropped EXE
UPX packed file
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments