MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ccce2a5d01211e5db0bcc8721dbea06422c5f3133466e4945e4d301d44df3b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ccce2a5d01211e5db0bcc8721dbea06422c5f3133466e4945e4d301d44df3b2
SHA3-384 hash: fc231eac12bbfb81a035bacec63a73b43453965b669756b315a956a619b9bd6e989ee10c202dee2ed41f4242f81dba82
SHA1 hash: 1b6cdc52550cb998da860db31502b1ccf9927a19
MD5 hash: c52a97ed790c3cb425dbb6a7431c3bbf
humanhash: delaware-mississippi-gee-papa
File name:8ccce2a5d01211e5db0bcc8721dbea06422c5f3133466e4945e4d301d44df3b2
Download: download sample
File size:395'264 bytes
First seen:2020-06-03 09:48:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f4693fc0c511135129493f2161d1e86 (250 x Neshta, 15 x Formbook, 14 x AgentTesla)
ssdeep 6144:k9zAN+Afg0gU8KISEvRHfsEGgHR4H94raeG8EvrDk2NdLNcm0:P+AfgsfEvRHfsE/wX7s2NdLCm0
Threatray 19 similar samples on MalwareBazaar
TLSH 1184A25263E94564F0F77F30DC754622AA377C859E3CC24E12909A6E2DB2B94EC38763
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Neshuta-1
Create hunting rule

PUA.Win.Packer.Pequake-4
Create hunting rule

Win.Virus.Neshta-7101689-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Win.Trojan.Jadtre-5
Create hunting rule

Gathering data
Threat name:
Win32.Virus.Neshta
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:08:18 UTC
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
0a5e60319a443610bd184d1d0140036332d56430e32976e79c6aeec24be7d701
147c11e1c610932b1c2e0413ff84b3e6db9b4e4da9a62294fae5e25aac590013
1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb
30906d9b754f0687ae3970b83f619a22cf338a478ef6a4165a8f7e378903f616
52055c63e2a063c0d4489918ff3bc7e63c9ff94bb56ad95003d8594d01bb81d2
5261874485f9fe16a78a558734e8652f93db1d544f3be331e7f6adc06f43ee98
b54934cb8e1ff68d2c4306e5a6eb0f9e649ad1680960253c0cfa0c35a6c4d313
c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9
e1614a878888eddb3296e856dc5f4e63a926b9e4c899cf09da12a8f477ace4cf
+ 9 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/201109-a1a5zsmjye/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Modifies service
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies system executable filetype association
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments