MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82e1f09888e9a5ed93bd6602eca4ab1daef1d6f74e6f1ef24ba6f1b2bc7d2565. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82e1f09888e9a5ed93bd6602eca4ab1daef1d6f74e6f1ef24ba6f1b2bc7d2565
SHA3-384 hash: 68d9472e3501a3af11610575ec48f307aa960eb58d8b1c1770cd2ca9f38a9b838e22bb3924533ec62b685f86b9901200
SHA1 hash: c7a206f5bafabb2d7c77c4a0336a25e0526a55ea
MD5 hash: e12c2a4644d4ec8303c409484ed90240
humanhash: carpet-purple-princess-dakota
File name:e12c2a4644d4ec8303c409484ed90240
Download: download sample
File size:1'347'072 bytes
First seen:2021-12-15 09:46:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:qw+5rzT6NGbCwYsYxgG/ju3WjOjQyOfSKKZfytYkc:L+5gwYsegKuRjQdfRKZfytYk
Threatray 9 similar samples on MalwareBazaar
TLSH T120551201B3F46B57F3B863F6443911204BF3396A68B5E3085D9691DD69B0F814AA2F3B
Reporter zbetcheckin
Tags:32 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e12c2a4644d4ec8303c409484ed90240
Verdict:
Malicious activity
Analysis date:
2021-12-15 10:24:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d44ac64b-9b2f-4c4e-9573-96897b211abb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/214277/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.31726.30830.6448.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Сreating synchronization primitives
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61b9b99981d232372002f32f/reports/3d8a043f-912c-4d8d-bf73-a1ddb24cf80f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/efdf91d2-0abe-4c6a-83fa-0dc9279fc47f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/907749
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82e1f09888e9a5ed93bd6602eca4ab1daef1d6f74e6f1ef24ba6f1b2bc7d2565/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-11 02:14:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
32
AV detection:
30 of 45 (66.67%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1d9683762af1b602fb4456c72287a79a013d8f89d32bb6a3c89752f0097af835
2393aff685506250605856957000f07aefef92d3d46213739b3244da2c014764
2f63e26c8923ba7b4d1ed579217a1ad99ed564cf467be04fdb4fadf96784df21
684eb557696d45ec516edbae21d19c390e4261aefab4dd87c1b01d2f12a36715
7384d454b01374378fe25bb0f25dd6bb8faae076610cff4917ccdf5274682830
b65f542c74ced21ba853b4840f0cfad311027e518b1c3925bd530a2da424293c
b874161b258cda3cab7439d074f5d2560532076b46a91ca19c6cb5893828d030
e72dc89990c2d78a89001f901515aa56c0c5da2c3d85fff3ca3ea2c1123b95c1
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211215-lr7snahca3/
Behaviour
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
dc3a913b1e77f94fbe07f7b29be760acfd5221bbf62bb124be0952374b4259af
MD5 hash:
9ca6bbe10c8200d5ef60449dfb330d48
SHA1 hash:
8562a8a680860536791f5f8311fe8677fb771762
Link:
https://www.unpac.me/results/027bd4f7-695a-47ab-9e34-716f7c701ea2/
SH256 hash:
82e1f09888e9a5ed93bd6602eca4ab1daef1d6f74e6f1ef24ba6f1b2bc7d2565
MD5 hash:
e12c2a4644d4ec8303c409484ed90240
SHA1 hash:
c7a206f5bafabb2d7c77c4a0336a25e0526a55ea
Link:
https://www.unpac.me/results/027bd4f7-695a-47ab-9e34-716f7c701ea2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82e1f09888e9a5ed93bd6602eca4ab1daef1d6f74e6f1ef24ba6f1b2bc7d2565

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 82e1f09888e9a5ed93bd6602eca4ab1daef1d6f74e6f1ef24ba6f1b2bc7d2565

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1887228/
Cape
Cape
https://www.capesandbox.com/analysis/214277/

Comments


Avatar
zbet commented on 2021-12-15 09:46:30 UTC

url : hxxp://coin-coin-data-6.com/files/3565_1639143132_1054.exe