MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f48e101007a2c4c4c5c80ce39f697f2958107c12ccfbc3ad521a7195ecceadc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f48e101007a2c4c4c5c80ce39f697f2958107c12ccfbc3ad521a7195ecceadc
SHA3-384 hash: e6c8dd1e7df60f2e7522e6ed2b5004e9bdb77b1f7e46c976251b182e7c126f76fb27e6f6bc09e1be1519c28228588772
SHA1 hash: b51f1aef3503e9f24716b4c266fea79c297f69cb
MD5 hash: ab150ba62a7bcb950485d78197546f68
humanhash: texas-white-quiet-video
File name:ab150ba62a7bcb950485d78197546f68.exe
Download: download sample
File size:2'044'747 bytes
First seen:2021-03-03 19:08:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 49152:HVaYcEUtO1glcSTqcnFFbc29XpAEqKCiGGoR8H:6EUtaO/FFHeExVoqH
TLSH 78953362A2ED0473E95457F41CAB820715303EB0CE18DB5353598A6E8CB2BCAD5F6F2D
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ab150ba62a7bcb950485d78197546f68.exe
Verdict:
No threats detected
Analysis date:
2021-03-03 19:26:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/da451fb5-8916-4719-b717-5cb3ee609839

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/122099/
Detection(s):
SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/626643
Signature
Binary contains a suspicious time stamp
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f48e101007a2c4c4c5c80ce39f697f2958107c12ccfbc3ad521a7195ecceadc/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-03 19:08:43 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210303-n658kzkg5n/
Unpacked files
SH256 hash:
6f48e101007a2c4c4c5c80ce39f697f2958107c12ccfbc3ad521a7195ecceadc
MD5 hash:
ab150ba62a7bcb950485d78197546f68
SHA1 hash:
b51f1aef3503e9f24716b4c266fea79c297f69cb
Link:
https://www.unpac.me/results/3a8589f1-fe81-4621-81bd-d84157ad3da1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6f48e101007a2c4c4c5c80ce39f697f2958107c12ccfbc3ad521a7195ecceadc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6f48e101007a2c4c4c5c80ce39f697f2958107c12ccfbc3ad521a7195ecceadc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1000821/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/122099/

Comments