MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 678f361d622c482253df9b834e978f8f3ca254fc5549381817dc75431005a047. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 678f361d622c482253df9b834e978f8f3ca254fc5549381817dc75431005a047 |
|---|---|
| SHA3-384 hash: | 903d62295751f85681a49661a10430c919e1e96bd523b58c0577096f7da06c15ec9a88204f8d7ad6e953f99108e5a8a4 |
| SHA1 hash: | bf83552fff44eb5e8c21ab9f3b661b744d2eda6c |
| MD5 hash: | 32b935362095a384f25c4a076754092e |
| humanhash: | uniform-fourteen-artist-avocado |
| File name: | file.ex# |
| Download: | download sample |
| File size: | 78'848 bytes |
| First seen: | 2022-10-18 12:08:16 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 16c6bf6371f9e8dfe90c401e12dcd31f |
| ssdeep | 1536:XRQG8Vy24Fr8WLmhZNHB55shjkhtaJYPgZ9e0aU:XRQJy24Fr8WLmZD6mh6YPgZA3 |
| Threatray | 2'830 similar samples on MalwareBazaar |
| TLSH | T174735B1B765540FCC0ABE17CD5876A42E3B5784A03129BCF03A0496B1F573E1AF7EA61 |
| TrID | 48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1) |
| Reporter |  500mk500 |
| Tags: | consulting-ukraine[.]tk exe |
500mk500
consulting-ukraine[.]tkukrsupport[.]info
Ref: https://www.virustotal.com/gui/ip-address/79.137.196.4/relations
Intelligence
File Origin
# of uploads :
1
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
678f361d622c482253df9b834e978f8f3ca254fc5549381817dc75431005a047.zip
Verdict:
No threats detected
Analysis date:
2022-10-18 16:12:58 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a file in the system32 subdirectories
Creating a file
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Threat name:
Win64.Trojan.Zenpak
Status:
Malicious
First seen:
2022-10-18 12:09:07 UTC
File Type:
PE+ (Exe)
AV detection:
18 of 26 (69.23%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 2'820 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Enumerates processes with tasklist
Gathers system information
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
678f361d622c482253df9b834e978f8f3ca254fc5549381817dc75431005a047
MD5 hash:
32b935362095a384f25c4a076754092e
SHA1 hash:
bf83552fff44eb5e8c21ab9f3b661b744d2eda6c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 678f361d622c482253df9b834e978f8f3ca254fc5549381817dc75431005a047
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.