MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 742f9f3fb0fb705d4363c00a685e8f2598cabbbeffdb1afc5a304b8ded7fab0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments 1

SHA256 hash:	742f9f3fb0fb705d4363c00a685e8f2598cabbbeffdb1afc5a304b8ded7fab0e
SHA3-384 hash:	cced73c88a6cb69ac06ad67883c937c8a599b6be632b8b7d3596249681d7d4be2bbf28881f7ff6b89800232510953cca
SHA1 hash:	d54871088c5781109af1fc7b593cde096413b718
MD5 hash:	956d9a9e550cca451c2f56d896a70c4d
humanhash:	nitrogen-lamp-muppet-nine
File name:	956d9a9e550cca451c2f56d896a70c4d
Download:	download sample
File size:	1'056'768 bytes
First seen:	2022-01-21 15:10:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:Cb1/119WfXGI9WfXGI9WfXGiiiiE9WfXGd333dv6nnjqKoe:CbTefXkfXkfXMfXk333d6nnjqKoe
Threatray	128 similar samples on MalwareBazaar
TLSH	T15F25E1673E808798CF5E46F5961A884033F8DCEFD908D60D5F853AD25BE4BD24A2172B
File icon (PE):
dhash icon	f2909696969ef66e (42 x AgentTesla, 42 x SnakeKeylogger, 13 x Formbook)
Reporter	zbetcheckin
Tags:	32 exe

Intelligence

File Origin

# of uploads :

# of downloads :

230

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/221532/

Detection(s):

Win.Trojan.Generic-9907631-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated packed print.exe replace.exe strictor

Link:

https://www.filescan.io/uploads/61eacd0d0f8c757253d54f3f/reports/aec06fa6-4ca6-4662-99c0-75d2bb08c2d2/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1db62b01-5f17-4f19-8ad2-660020d617aa

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/925294

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/742f9f3fb0fb705d4363c00a685e8f2598cabbbeffdb1afc5a304b8ded7fab0e/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-01-21 15:11:12 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 27 (85.19%)

Threat level:

5/5

Verdict:

malicious

11ca82326f28ef0ef508f6b693d67f3df5d9e538e58b3a130570c94901cd320c

1d26c95886033e5aec760fdceaafacf8d6e7d23088b695b9e04031d1061ad0ef

4609093cae7be486994f47b76f6f254001fbfd697fea54835ffaa5410f393728

4f599beabdefba8e35fbf30ddfb2d2c135d09bf83899f361bf6566af61e873ef

4f932ea60ac54baa3d8a26705d2ba0013b6728576055457e301ffe96efd082c2

723abb6b0dee5d6f012a695ca483478595a08ba3b0dc73ca2032c8d4699605cb

745e05c58713c838b50e3f17baf40bd8af9fc55f690584c024a54a884f1fc462

dab5b9cc29c359aa8e5ae59241d40290048e6dd13e32951c0ae964181b40a5c4

dcc30daa103f38a83d8f731cf1d6dccdfd53d20e27b6944fd328cd78149beba8

+ 118 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/220121-skleeahhe4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Unpacked files

SH256 hash:

aab2f89239f9a7a2d6bfd4fd64405a4ea0a65e83ed6938133f547e32f1cc56e1

MD5 hash:

a6db24806f365a897a068c49a536ad74

SHA1 hash:

8de1085c2fa70106b93e11d9d9dcd32088dccd5a

Link:

https://www.unpac.me/results/bf127d6f-4307-4a91-8dfd-6af0864ccd3a/

SH256 hash:

742f9f3fb0fb705d4363c00a685e8f2598cabbbeffdb1afc5a304b8ded7fab0e

MD5 hash:

956d9a9e550cca451c2f56d896a70c4d

SHA1 hash:

d54871088c5781109af1fc7b593cde096413b718

Link:

https://www.unpac.me/results/bf127d6f-4307-4a91-8dfd-6af0864ccd3a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.38

Link:

https://yomi.yoroi.company/submissions/742f9f3fb0fb705d4363c00a685e8f2598cabbbeffdb1afc5a304b8ded7fab0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 742f9f3fb0fb705d4363c00a685e8f2598cabbbeffdb1afc5a304b8ded7fab0e

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1995860/

Cape

https://www.capesandbox.com/analysis/221532/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-01-21 15:10:43 UTC

url : hxxp://103.167.84.15/intel087(R)/.winlogon.exe