MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f7f2ea8d98aa55fdeacc91fdbe55edd4ad238ee0cbc55b98058411e6f9568ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f7f2ea8d98aa55fdeacc91fdbe55edd4ad238ee0cbc55b98058411e6f9568ea
SHA3-384 hash: e8b171cd06b7f08596d3b549c123e77c61419b44060ca8c45e42dc74d4f9606e4cba86e4732e855b3bc470c89b62b8cf
SHA1 hash: 7725e0e33737151c4b861dc1172ab8e14443fad7
MD5 hash: a16ef8202130ad41e2dbe7005a395138
humanhash: enemy-bluebird-batman-zulu
File name:6f7f2ea8d98aa55fdeacc91fdbe55edd4ad238ee0cbc55b98058411e6f9568ea
Download: download sample
File size:677'888 bytes
First seen:2020-11-11 11:25:10 UTC
Last seen:2020-11-11 13:04:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:LT9KA+LOD9SETglMSR9oqGtlLry3TYJ7UAGkoDFDiRjXRj62uMK0TL/Ff0KY5ns:YAEOD9dTglMLq0UAG1DNiRjBj7X98zns
Threatray 6 similar samples on MalwareBazaar
TLSH 99E48D1773449B21C77922B8C0EB542493F2D9AB5333F7A93E8412DC089635BFE4A64E
Reporter seifreed

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader25.6662.15286.25369.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f7f2ea8d98aa55fdeacc91fdbe55edd4ad238ee0cbc55b98058411e6f9568ea/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 11:28:18 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9
1af23919d3e943f51b279e81dd75b9005ed22e550817e5e76eef825864e600d3
2a03af662a64d3deb050b7a329060214b46dbb817aeb1fed697929b3db962388
75bc87dafaa424cba64308b349fc324d263e2a3e267c59962a79da9005caafb4
ac9585a2b073ae83bd5447fa7be6aecd242a4b70c024bd200fd691c763878fe1
dc7eca029a78b39613bff941031b613939680b1d019cc6ac84960263232b22e3
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/201111-kwcsdsexrx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
6f7f2ea8d98aa55fdeacc91fdbe55edd4ad238ee0cbc55b98058411e6f9568ea
MD5 hash:
a16ef8202130ad41e2dbe7005a395138
SHA1 hash:
7725e0e33737151c4b861dc1172ab8e14443fad7
Link:
https://www.unpac.me/results/f353b437-e5c7-4e4b-a1ae-35c4250a99c4/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments