MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 61845568bb072984b6dba5151ede3969440736a7d7d674de0137ca4b7b8ab6e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 61845568bb072984b6dba5151ede3969440736a7d7d674de0137ca4b7b8ab6e4 |
|---|---|
| SHA3-384 hash: | e080cb508f1ec622b1a1a2c44e1502b470b2dc212e631a03cea8a67eade39435b01ac86e80fc204c2759a29e9684945a |
| SHA1 hash: | 18ab5973145dd016c34d536e2ac9a750592187bc |
| MD5 hash: | bffb13fc28cabed46313b33d437f0f90 |
| humanhash: | sixteen-fourteen-lima-berlin |
| File name: | [PDF]-Maintenance-Re_hjZpegiO.exe |
| Download: | download sample |
| File size: | 7'489'090 bytes |
| First seen: | 2022-07-25 08:54:24 UTC |
| Last seen: | 2022-07-25 09:52:24 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | da86ff6d22d7419ae7f10724a403dffd (1'679 x GCleaner, 1 x Socks5Systemz) |
| ssdeep | 196608:HZ8BLPt2zK/vLp3PO1KLpDFdfI9mekSWf:HOt2zKdIKL/dwAe1+ |
| Threatray | 94 similar samples on MalwareBazaar |
| TLSH | T1E976334CB95CC8F5C5B3C2F4FA0E1701422B7BB18EC656CA9B490916E53F39B985A78C |
| TrID | 81.0% (.EXE) Inno Setup installer (109740/4/30) 10.4% (.EXE) Win32 Executable Delphi generic (14182/79/4) 3.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.2% (.MZP) WinArchiver Mountable compressed Archive (3000/1) 1.4% (.EXE) Generic Win/DOS Executable (2002/3) |
| File icon (PE): |  |
| dhash icon | 686c74f4c2e8e4c0 (1 x LummaStealer) |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
254
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Creating a file in the Windows subdirectories
Moving a file to the Windows subdirectory
Modifying a system file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
80%
Tags:
greyware overlay packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Machine Learning detection for dropped file
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Ekstak
Status:
Malicious
First seen:
2022-07-25 08:55:08 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
11 of 26 (42.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 84 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in System32 directory
Checks installed software on the system
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
6e29c2c471aa6323bcecddfe47dc3bf65a2c74d88acd513126e7383001d1f141
MD5 hash:
4c424b3f08f1161705991d17450eac70
SHA1 hash:
b4e3e5c1fe8ed5ead8950163d224be886f07e9ad
SH256 hash:
de6a9d52bc7ce2ad78c63ac24c1b33e5664c52ea9b61e4c90708f941cd0dc5ce
MD5 hash:
250afc0033e9ba5c35d25043a408bd49
SHA1 hash:
ebfcb95653d3b6cd53a9c57707295b4f5ccb73ed
SH256 hash:
b767035092bbee2b1f0b05015a3eb9b02701046da89372c1480cfd2a6e66ea69
MD5 hash:
433db239e8ec8108ecb3980dbe2084fd
SHA1 hash:
10bc609065fff475a19e93f54cc35c84a99fc5b2
SH256 hash:
61845568bb072984b6dba5151ede3969440736a7d7d674de0137ca4b7b8ab6e4
MD5 hash:
bffb13fc28cabed46313b33d437f0f90
SHA1 hash:
18ab5973145dd016c34d536e2ac9a750592187bc
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.