MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75b388003cc32b680abc3d9b41bc6c435af723de235eaab36a323fddcb906f62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75b388003cc32b680abc3d9b41bc6c435af723de235eaab36a323fddcb906f62
SHA3-384 hash: 7ef0e737bc76403064956374a3eea2b3a27fef77867cbf14bc6df4eb8a2ec562dd73b8893871f09890dab1df4f9bf431
SHA1 hash: 74fa2d6b4e61153d360d8d76c38a0f9f2139cb6a
MD5 hash: 5808d100a45cc08d742b57f82721ff9d
humanhash: west-seven-don-vermont
File name:5a065c7a115a29b15bf382aec7641887
Download: download sample
File size:391'680 bytes
First seen:2020-11-17 11:23:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b434ea836ccd287107087117416aaac3
ssdeep 6144:KlmkG8laCvcZ0BTLiykCAdtMr5LtsErQiE5H8AOllahjrp8/Jqq3fF5ZZFkT1PTB:KlmX8lajZui3CAw1BsEFE1nZh523fFfK
Threatray 70 similar samples on MalwareBazaar
TLSH 6A8423CE81B40F37E6480975C67B10466EDE119180942D4F592DD6ADBBFF2ED22228FB
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Win.Trojan.Ag-4254306-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Verdict:
0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75b388003cc32b680abc3d9b41bc6c435af723de235eaab36a323fddcb906f62/
Threat name:
Win32.Infostealer.Snojan
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 11:24:22 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
2a214959e1a85a4d11444053d4262961ee29e2cc53c3f4ae8f1a59152e5d67f3
2e13c882d28c2236893a0a543e67c74a4f2e560d98c98b800f95c07938156a37
3bb1bbf49c6e224032025dc7dacb3862e8b16c8b39e5cc19c5aceda4dbc917d9
56133c0d017af35f49253926e3583cf72c36146ab7faa65b6058971685166652
6ed0051747d0d5fbf4273b02e7267a257a82217c4b474117ea853014218b2b18
7333ddf4a7e53eeda33a8360b307471358597aeff78f4a5a7f4610640f97bdc7
799b7395c9f279d8cd1cd24657788ecb37db7ae03c0dddeb3344a95a551d1325
82385c5627675bb1a2f760238c766d1b8d3c31e109e067334959c084d62e5d55
8f327b1ce9510b718d832e0d0d38caf1aa73c3af31f6a915442f5b90015e7e6e
bd668ef292ae01d2ed9a32b1ea054e2acb484f61e86481f306669637ba31ce82
+ 60 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201117-6nprgk63d6/
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
75b388003cc32b680abc3d9b41bc6c435af723de235eaab36a323fddcb906f62
MD5 hash:
5808d100a45cc08d742b57f82721ff9d
SHA1 hash:
74fa2d6b4e61153d360d8d76c38a0f9f2139cb6a
Link:
https://www.unpac.me/results/4ab6fde5-b2f1-4e6f-af10-9a0b4ef4c108/
SH256 hash:
640a510c7ebc5b6041410058a8345afb3ddbf0e8bd533ba5456e4627ba08011b
MD5 hash:
9551b559989824cba94e84347311cece
SHA1 hash:
e1e98fbaf9a651fa956bcb2bd28da08e5996fdb2
Link:
https://www.unpac.me/results/4ab6fde5-b2f1-4e6f-af10-9a0b4ef4c108/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments