MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 802ddf30debfce4add361a2926203e00c1a5ca1bb9e131b00507d491b8d5911b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 11
| SHA256 hash: | 802ddf30debfce4add361a2926203e00c1a5ca1bb9e131b00507d491b8d5911b |
|---|---|
| SHA3-384 hash: | 5475961bbdbf2b52cab80eb2a2ae47fbae758bd01eab43ab77138746d191f6934985bfd1c37c40709dbed012a86cd800 |
| SHA1 hash: | ba6a7eabf7564f60cb35e8b54959fb890e63a617 |
| MD5 hash: | 3ab9f05175c2657a3f7d3e6fcfd2a7cb |
| humanhash: | oregon-timing-juliet-nuts |
| File name: | 802ddf30debfce4add361a2926203e00c1a5ca1bb9e131b00507d491b8d5911b |
| Download: | download sample |
| File size: | 4'665'649 bytes |
| First seen: | 2023-01-06 11:54:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'452 x Socks5Systemz, 262 x RaccoonStealer) |
| ssdeep | 98304:NSSL/sY2n0p+wH7nECsdEzCaj9yDWgc3PjxDrHkrEvvur:NSP1nknH7UY/MDWgcflDrErEvQ |
| Threatray | 2'612 similar samples on MalwareBazaar |
| TLSH | T1002633926D84D97AD31925F4F62504F4C2EF3E0EC868420F6DA9FD497B3D6E208F9648 |
| TrID | 78.6% (.EXE) Inno Setup installer (109740/4/30) 10.1% (.EXE) Win32 Executable Delphi generic (14182/79/4) 3.2% (.EXE) Win32 Executable (generic) (4505/5/1) 2.1% (.MZP) WinArchiver Mountable compressed Archive (3000/1) 1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| File icon (PE): |  |
| dhash icon | 4a0c4d454d4d4d0c |
| Reporter |  adrian__luca |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
177
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
802ddf30debfce4add361a2926203e00c1a5ca1bb9e131b00507d491b8d5911b
Verdict:
Malicious activity
Analysis date:
2023-01-06 11:54:41 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Modifying a system file
Sending a custom TCP request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Launching a process
Query of malicious DNS domain
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
greyware overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Signature
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Ekstak
Status:
Malicious
First seen:
2022-12-10 09:27:39 UTC
AV detection:
15 of 26 (57.69%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 2'602 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Checks installed software on the system
Loads dropped DLL
Executes dropped EXE
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
590beff18e862e27b2fb92dd65170297c6e6646c960cf6e742dcb8a0fa8c7988
MD5 hash:
e2996dff751f9eb7ed4bd1c4d86b33d6
SHA1 hash:
ed3a1dd17478d510619dcbe01cc138cdd02e3103
SH256 hash:
eb334a5747792273d11ba63582784b156ab840547d73eaab36af881846f3e7c4
MD5 hash:
d548db9b9f93065f60df8dc7a3b7de2b
SHA1 hash:
d4853d0c417a74e308d114ae1b68e9f0bf02e477
SH256 hash:
e2fd7f49360fce1c5d31cb07c3a6ea72c76f68a9728ce6ca962fa1bcbf1131f5
MD5 hash:
16e7bd7958aac924177607ec297b9daf
SHA1 hash:
2ba60707b6866ce5fdeb123a7d0f376bd5e08267
SH256 hash:
8757a3a06dbc76dc75011fb41e4e532288c124b2faa4e8e8cad2ca29ef833a18
MD5 hash:
b5eb8c66c23c53fc6d276e8d341af37a
SHA1 hash:
5ef5c88eca7c974075a41304fcd0f160655e5921
SH256 hash:
802ddf30debfce4add361a2926203e00c1a5ca1bb9e131b00507d491b8d5911b
MD5 hash:
3ab9f05175c2657a3f7d3e6fcfd2a7cb
SHA1 hash:
ba6a7eabf7564f60cb35e8b54959fb890e63a617
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.