MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 82a3a3234c7dbddf79b32b1cf05cd7d5806512824d0536edcbce4dc529519d92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 11
| SHA256 hash: | 82a3a3234c7dbddf79b32b1cf05cd7d5806512824d0536edcbce4dc529519d92 |
|---|---|
| SHA3-384 hash: | 9e8c2c65e1f2085f57d8754c5fc76ad282443d168080d9f1ddc3675d33404cc2e5ed03710879485c3c34595daed96d10 |
| SHA1 hash: | 30f06a777f2669c7030050f0d90299068d676509 |
| MD5 hash: | 91dbbf3def818faf5e27ef36ee4e1f15 |
| humanhash: | west-georgia-undress-wyoming |
| File name: | 91dbbf3def818faf5e27ef36ee4e1f15.exe |
| Download: | download sample |
| File size: | 3'145'728 bytes |
| First seen: | 2023-04-28 11:09:52 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger) |
| ssdeep | 24576:yIltR5nfapskuL0Wukzm9vfOoo/uug6u+xviDy/kE2XXP33XVi: |
| Threatray | 43 similar samples on MalwareBazaar |
| TLSH | T162E59EF4907B44C6D80BAEC3697CBDE7073672F3CED50454137E39484F27AA9890AA5A |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
245
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
91dbbf3def818faf5e27ef36ee4e1f15.exe
Verdict:
Malicious activity
Analysis date:
2023-04-28 11:27:07 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Searching for synchronization primitives
Launching a process
Launching the default Windows debugger (dwwin.exe)
Deleting a recently created file
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Verdict:
Malicious
Labled as:
Tedy.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
80 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-04-28 10:30:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
21 of 37 (56.76%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 33 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in System32 directory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
d5c5eab0ca3a334b9535c0482e33c787809cbfecf2768ce5a357765f333b72a3
MD5 hash:
9534362ea0a3c1271bae26b1c3931a04
SHA1 hash:
e3a9e5379b3f07f2d79d477717be56dca6d1467a
SH256 hash:
6b77e2bfff019609c509c3e559c6870dbb7e8d8b9979affb98440e079c99e354
MD5 hash:
958e4d62824c29a594256646c3d6bbf9
SHA1 hash:
e2f2004a3932381c8e70ecde39a129f0f6add9b0
SH256 hash:
7331b48b3b18efcaea0255bf4670147ac7c3331ea9ea4ce2f7baa09f2ec34c31
MD5 hash:
f6b737d88b63a7fed24c5719d71c4784
SHA1 hash:
605178689aadb11d6cd94d20cb3b01a2d717ffbe
SH256 hash:
dcf974b5d344ded7796acbdc71fad6279a9f8adcbd67a8173b21e1aeec74a902
MD5 hash:
8203484c1e2651ab2b2927d9f0f14adb
SHA1 hash:
3fbec0fbf1397be4449cdf515d43874059f871a2
SH256 hash:
8dc83a91438acf1fbb3ca34e7bc62d74368b05adfb4b2ac998aa2dd100b156c0
MD5 hash:
67a385984bcaf4bbe166ba808cd3ebc8
SHA1 hash:
d6ca2a476900cb0949a54edb4d73fb63b8673b7e
SH256 hash:
ff8c24bce1eb009f0d5c47a09b96caf02726c285cea0d635082ad4da27e63d1b
MD5 hash:
9d6ec6072ee1814a4a01d1eb3fb67ba1
SHA1 hash:
d0b416de1c900b6bcb35dc182b2e8744f16c3289
SH256 hash:
e54e2e048b322f92b6ffd0252075b03b57ef976d019f38e7afc25a0e73196729
MD5 hash:
117a394c6d15fa4f385fb095d4e1d63c
SHA1 hash:
311b45231cd51c3a35ac126470cce8111896717f
SH256 hash:
82a3a3234c7dbddf79b32b1cf05cd7d5806512824d0536edcbce4dc529519d92
MD5 hash:
91dbbf3def818faf5e27ef36ee4e1f15
SHA1 hash:
30f06a777f2669c7030050f0d90299068d676509
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 82a3a3234c7dbddf79b32b1cf05cd7d5806512824d0536edcbce4dc529519d92
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.