MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 749b3f20f5f70063a5499dd6a97e04a474e055a8c41422093b88a2a50a9da99c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Adhubllka
Vendor detections: 11
| SHA256 hash: | 749b3f20f5f70063a5499dd6a97e04a474e055a8c41422093b88a2a50a9da99c |
|---|---|
| SHA3-384 hash: | 61601ae365548bb922b5064fe71641ace61d54c81e937a5331bf0681f2a6e4cc59f38f03fc37a74d80a9fcd8a6951330 |
| SHA1 hash: | 41c9109b13d129447ffdf273f78c8fee6096ff81 |
| MD5 hash: | 29250c34e78857b17ee2576f68757d01 |
| humanhash: | monkey-spaghetti-montana-black |
| File name: | file |
| Download: | download sample |
| Signature | Adhubllka |
| File size: | 699'392 bytes |
| First seen: | 2022-12-01 17:01:53 UTC |
| Last seen: | 2022-12-01 18:30:26 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:8vMoijCXzXEG0hfzotlHPeBfzNJnNd+2yj6IOUHF+TyybcBsDk:7y7b0hEtlvM9+2c3l+Tyy5k |
| TLSH | T18CE4224033DF6B26C2BEE7F18822A60651F6F8674653EB8E3EC934990F13B64C645746 |
| TrID | 61.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.1% (.SCR) Windows screen saver (13097/50/3) 8.9% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  jstrosch |
| Tags: | .NET Adhubllka exe MSIL |
Intelligence
File Origin
# of uploads :
2
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-12-01 17:03:43 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
DNS request
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Searching for synchronization primitives
Moving a recently created file
Changing a file
Modifying an executable file
Сreating synchronization primitives
Creating a file in the Program Files subdirectories
Moving a file to the Program Files directory
Moving a file to the Program Files subdirectory
Launching a process
Modifying a system executable file
Setting browser functions hooks
Encrypting user's files
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BitRansomware
Verdict:
Malicious
Result
Threat name:
Cryptolocker
Detection:
malicious
Classification:
rans.spre.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Drops executable to a common third party application directory
Found ransom note / readme
Found Tor onion address
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes a notice file (html or txt) to demand a ransom
Yara detected AntiVM3
Yara detected Cryptolocker ransomware
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.RealProtect
Status:
Malicious
First seen:
2022-12-01 16:28:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
19 of 26 (73.08%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
10/10
Tags:
persistence ransomware
Behaviour
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Enumerates connected drives
Modifies Installed Components in the registry
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
64ebb3ddffab7cd88e10df843bd65f02023ad7f2ebc085d72466d437a2b8c9d7
MD5 hash:
3056b523cbe47211e9dc4840a2e5f9a7
SHA1 hash:
7ca6fd010d9c860db9f529c5e8770b8b58296e60
SH256 hash:
617bf140c033b5b8aeac786be73bbd3fa93ca141f16f21774e907f59876b7c30
MD5 hash:
dde7c7a8647fa96bdfa49183a2528033
SHA1 hash:
4b034c68360539b74dca1de513e77590bcc9f002
SH256 hash:
89844786bb2290797309c881c49a38f8502c39342bf2d9fecdc4ac5b4735f1d4
MD5 hash:
842d42bb052a77759c8f55d46021b2e0
SHA1 hash:
497403d1ba51ce198a46221395daf240c206bb36
Detections:
win_adhubllka_auto
win_adhubllka_a0
SH256 hash:
505bbce200ea7866b45fcfb6b722b775d2e67085e73b76f30ba9bd81bac12742
MD5 hash:
78b5ae2048aad2df2c0fac2be888abda
SHA1 hash:
f023f8a59353a3ba350af1880ec0a437866ea82e
SH256 hash:
364a3cb98c164f72086bf48f68ddbbc7c89927a4e09ff843184562fa8f5859ef
MD5 hash:
d47573bd41a60f5d0c0e8153fb08dad8
SHA1 hash:
d8d66e9e2ea4100eb2422eff97d3e0e36fc2b756
SH256 hash:
6fe2b8e2ac8c2d5b5920756b81d9a2bc0744a96ea03543aed92d56ea0ab1633a
MD5 hash:
7979f20656e85c7496bfffef14c5dbf1
SHA1 hash:
ba91d7f67bf48ab894ac87255bc9681bd7004b9d
SH256 hash:
ba5f6609688d7942285fea099dd756244fb0c03bf056f96cb44f10a99224ed4a
MD5 hash:
f19bd6d334d94dc079bcbada9ede5bc4
SHA1 hash:
8e45cf5aceae3af7aa9f0d35670b70891f0864c2
SH256 hash:
e23c9cbd9f24b876f0ab78c3340c25ae5723c9842c1b4712738aac8883b37d41
MD5 hash:
ebe0dc28f00a737095a89b2ef30f6460
SHA1 hash:
1a30bb252eb95188e96917a897d42e8720b48bd5
SH256 hash:
749b3f20f5f70063a5499dd6a97e04a474e055a8c41422093b88a2a50a9da99c
MD5 hash:
29250c34e78857b17ee2576f68757d01
SHA1 hash:
41c9109b13d129447ffdf273f78c8fee6096ff81
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.