MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 61f1194b2b3a4dc3b4861a5a61c8dc58bce93a0ad0b18f61c8d66dbdbc04972c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 61f1194b2b3a4dc3b4861a5a61c8dc58bce93a0ad0b18f61c8d66dbdbc04972c |
|---|---|
| SHA3-384 hash: | 9782472a54e89b73bde63410ab8b46a206de583bb8a500f720c9c24a257fd372dc6c798e2b2584e7ccd4a4458d2e6bc0 |
| SHA1 hash: | d4c0b9a17d2b6bdf46db3df8c2bdd6757c7b14ab |
| MD5 hash: | 3cc60bfb565f90ba1fcf7cbe80471c85 |
| humanhash: | high-hotel-vegan-sodium |
| File name: | Pandora v2.41.exe |
| Download: | download sample |
| File size: | 4'062'720 bytes |
| First seen: | 2022-04-06 05:12:29 UTC |
| Last seen: | 2022-04-06 05:58:17 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b87fdacff8ab4bf476a24b846e70f6ad |
| ssdeep | 49152:bGtlq3BIU6iSwsEA9vVjQLNKK1Yh0iXr1nsl8VybcVefsSe49O8jYBz8M1T3+iPe:g+S00AYh0iX9sitI2z8Iq+TV |
| TLSH | T1B5168D52A7A800E8D4B6D1388A56D233D7B17C5523B08BDB12E4CE6B2F676E15F3E350 |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  adm1n_usa32 |
| Tags: | 64 exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
272
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
expand.exe greyware
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Behaviour
Behavior Graph:
Threat name:
Win64.Trojan.Mamson
Status:
Malicious
First seen:
2022-02-24 11:05:41 UTC
File Type:
PE+ (Exe)
Extracted files:
18
AV detection:
17 of 26 (65.38%)
Threat level:
5/5
Verdict:
malicious
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Unpacked files
SH256 hash:
61f1194b2b3a4dc3b4861a5a61c8dc58bce93a0ad0b18f61c8d66dbdbc04972c
MD5 hash:
3cc60bfb565f90ba1fcf7cbe80471c85
SHA1 hash:
d4c0b9a17d2b6bdf46db3df8c2bdd6757c7b14ab
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 61f1194b2b3a4dc3b4861a5a61c8dc58bce93a0ad0b18f61c8d66dbdbc04972c
(this sample)
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.