MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6d006ec6fb6d8741a3dc50c6f0131eb90bacbb9c49b60f02e1be2049aa4f2255. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 6d006ec6fb6d8741a3dc50c6f0131eb90bacbb9c49b60f02e1be2049aa4f2255 |
|---|---|
| SHA3-384 hash: | 2e4036023e2f1d7b2e0d7c560b60b0cb507a2ca2e37a1d9af3d58d603defa3e43e80e3cc16ffaac812f157bcf0a2ddf8 |
| SHA1 hash: | 325835583b5375622f332af1d3450252d0c9fb03 |
| MD5 hash: | ef1f929186c436b78b1b1639de196cdd |
| humanhash: | muppet-pasta-king-one |
| File name: | Our New Order May 03 2021 at 8.70_PVV550_TXT.exe |
| Download: | download sample |
| File size: | 1'328'640 bytes |
| First seen: | 2021-05-05 15:26:57 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 1536:Na9tNoH3uvOnc2ue8t958YYHW5Xr9W4qpjm4oY96RQJoHr18WA10jRQX973JBfwT:M |
| Threatray | 74 similar samples on MalwareBazaar |
| TLSH | E25524A0B32E6B40BBA403B0BF4E30E0262E19BA117B5ECAD651724D6F35F199C55773 |
| Reporter |  abuse_ch |
| Tags: | exe RAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Running batch commands
Creating a process with a hidden window
Launching a process
Unauthorized injection to a recently created process
Sending a UDP request
Adding an access-denied ACE
Creating a file
Sending a custom TCP request
Reading critical registry keys
Creating a window
Using the Windows Management Instrumentation requests
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
72 / 100
Signature
.NET source code contains very large strings
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-05-05 15:27:08 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 64 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
d6db20122633155ba992b5eacfdf54a5645a8ed4270b62bf1f20b95c95323069
MD5 hash:
0e5aff01681fc731746b39b92a496c0d
SHA1 hash:
88d32f7ee76bead523beaf25fa80c071cbc24852
SH256 hash:
908e6e670915bb46722661c6070c0ce3b53c8ed64f9e55502d607e0a7642d7af
MD5 hash:
60bf1ba5bf3185040c4af5e357be19c4
SHA1 hash:
c41adac6825dd7dcb7bbe873cfb58e2d4abe9cf1
SH256 hash:
3f5e24c2810f4b6211fad6d14ddd4cb879ad253509d92430ec752631c33e9b6b
MD5 hash:
c26b75dd948b9095df26db4f2e3bf1e1
SHA1 hash:
ae2d6876543023b9beaf130907649a5cdbddadae
SH256 hash:
6d006ec6fb6d8741a3dc50c6f0131eb90bacbb9c49b60f02e1be2049aa4f2255
MD5 hash:
ef1f929186c436b78b1b1639de196cdd
SHA1 hash:
325835583b5375622f332af1d3450252d0c9fb03
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu |
|---|---|
| Author: | ditekSHen |
| Description: | Detect executables with stomped PE compilation timestamp that is greater than local current time |
| Rule name: | INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture |
|---|---|
| Author: | ditekSHen |
| Description: | Detect executables with stomped PE compilation timestamp that is greater than local current time |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.