MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 647260f08017b3f63e2c5178e751b9d37503850cc18aeaa367506e7808b1e249. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 647260f08017b3f63e2c5178e751b9d37503850cc18aeaa367506e7808b1e249
SHA3-384 hash: 298c56cd9a49529c167ef59310dd55105ccbb4c46e583bdc278e38315ffc1ff34980f636b7500dc055f63717bed742d4
SHA1 hash: 732c517535417d9c4528a1bb41523b86d2156468
MD5 hash: 330827752c6d9fc2cd8ea6b6f3513182
humanhash: glucose-uniform-yellow-diet
File name:647260f08017b3f63e2c5178e751b9d37503850cc18aeaa367506e7808b1e249
Download: download sample
File size:715'413 bytes
First seen:2020-06-03 09:24:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 369fe35b86c83b3130c02698158a4d4d (14 x Formbook, 4 x RedLineStealer, 4 x AgentTesla)
ssdeep 12288:mhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNm/3c2Q:WRmJkcoQricOIQxiZY1WNm/s2Q
Threatray 186 similar samples on MalwareBazaar
TLSH 68E47B22A9818035F1B222715E7AF37596296D260222E1F737C73DF51E71F42EE39632
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PrivateExeProte-16
Create hunting rule

PUA.Win.Packer.Ep-7
Create hunting rule

PUA.Win.Packer.Embedpe-3
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Win.Malware.Autoit-6991628-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.BackDoor.IRC.Bot.3238.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 04:29:30 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
38e5fde6988bbf02467d7b59ba15a3dfbdaedfab4804c60cf3ae44db6b48a844
62e2d0479075cb28a37635972b9d3ad111e77b86b70de000409e11fe3f1d025a
6c5e170ec02d30c57a8bbceb8533eb73efd7b46f8ae1cd6e552fa6a5656afb36
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc
9129967bfcf44c87ec6eb83a30f5500a5e453c76281b7ec3b0c1caa778377e08
aff4652e2ee285a5ad71717a36e215c1eb59787d74e73a763701b0a5f68751a7
b24cb4cd3db305d5451cb3c0d0e60fe578b1fd38aca4be6032fb0ce2f0b786b4
ed105272dc3c77f54e7d170474afa6590a98477e6b076d7e5d1cf6c5e152319d
f68540d889b9b94e234a154fcb67255d635c8dd095c38e2d0356d1cd061c1e65
fb400e7c4b16ab67fa5c080f8b1e7f7db965b77d097526a6a28ef5ca34f24bd9
+ 176 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-15raybttwn/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments