MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e30e3bba90df2ef88f20ed393b9468b4c1813776a48e9d0b07441cabb7effcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments 1

SHA256 hash:	5e30e3bba90df2ef88f20ed393b9468b4c1813776a48e9d0b07441cabb7effcf
SHA3-384 hash:	fde77bbb25890d666363dcec7146f4fe54c433b9dfff8d778f916d952b3e5a5dca85b9e04a7bf784cc392a204e729488
SHA1 hash:	253555d42ebe3b16f156804f28905f77903055bf
MD5 hash:	8777690a74362f7a9b5396377d7296f1
humanhash:	mobile-equal-comet-robert
File name:	8777690a74362f7a9b5396377d7296f1
Download:	download sample
File size:	49'152 bytes
First seen:	2024-07-08 16:44:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	533d64189d09ea0939f934719c3357e2
ssdeep	384:aOadOzoHJmlphybWWXVauJoFnqowWX9VIkgroLCTD0xTlDsq8tgfpMl3v/tn4r12:Fa0yCgXcuJohqoTVNgrQFzAq8gMt94x2
Threatray	1 similar samples on MalwareBazaar
TLSH	T1CF239C7E6DE30637E00455B2DAF686C29FBF291334E3682FDB00585D2E2465848A6FF5
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	3974f6ecfcd8f0bc
Reporter	zbetcheckin
Tags:	32 exe

Intelligence

File Origin

# of uploads :

# of downloads :

338

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

5e30e3bba90df2ef88f20ed393b9468b4c1813776a48e9d0b07441cabb7effcf.exe

Verdict:

Suspicious activity

Analysis date:

2024-07-08 16:48:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/af3ba2fd-9068-400d-a9c3-0871ba988826

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=668c179080ab330aba4abe86win10vpnfull_triage

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Verdict:

Malicious

Labled as:

TrojanDownloader/Agent.bae

Link:

https://www.hybrid-analysis.com/sample/5e30e3bba90df2ef88f20ed393b9468b4c1813776a48e9d0b07441cabb7effcf

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/04b5dc66-dfaf-447d-b6f9-fd4c937927c5

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

3 / 100

Link:

https://www.joesandbox.com/analysis/1469298

Behaviour

Behavior Graph:

n/a

Score:

24%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/5e30e3bba90df2ef88f20ed393b9468b4c1813776a48e9d0b07441cabb7effcf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5e30e3bba90df2ef88f20ed393b9468b4c1813776a48e9d0b07441cabb7effcf/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2024-07-08 16:45:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

6 of 24 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lyyoho5jbxzo7chsb3jzhokgrngbqe3xnjeotufqora4vo3677hq._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/240708-t9dars1bra/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/447a2bc8-e270-4954-a974-c816724456e6

Unpacked files

SH256 hash:

5e30e3bba90df2ef88f20ed393b9468b4c1813776a48e9d0b07441cabb7effcf

MD5 hash:

8777690a74362f7a9b5396377d7296f1

SHA1 hash:

253555d42ebe3b16f156804f28905f77903055bf

Link:

https://www.unpac.me/results/8f66019f-1201-45a3-ae0c-9d72dcbd0eb3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.81

Link:

https://yomi.yoroi.company/submissions/5e30e3bba90df2ef88f20ed393b9468b4c1813776a48e9d0b07441cabb7effcf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 5e30e3bba90df2ef88f20ed393b9468b4c1813776a48e9d0b07441cabb7effcf

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2944604/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-07-08 16:44:45 UTC

url : hxxp://111.230.72.242/msf.exe