MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8d9ed28e4ff869fb32f2f4a97c12d40c43942e72a31e9c14c3ce6ddfa0eb63be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 8d9ed28e4ff869fb32f2f4a97c12d40c43942e72a31e9c14c3ce6ddfa0eb63be |
|---|---|
| SHA3-384 hash: | 911c098ad52e98fe646652e2919568ffc41635a1d89d82556f93afb5e7e6e88e89811224a06e8257c1d16488e3f6ddf5 |
| SHA1 hash: | 40acca2f51a9f40ed4e671ebcbd0233c4149dc08 |
| MD5 hash: | 7d490b957c53094cb972141b082c0b41 |
| humanhash: | jig-comet-sad-cold |
| File name: | 7d490b957c53094cb972141b082c0b41.exe |
| Download: | download sample |
| File size: | 457'728 bytes |
| First seen: | 2021-10-07 09:05:07 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7182b1ea6f92adbf459a2c65d8d4dd9e (5 x CoinMiner, 4 x RedLineStealer, 4 x DCRat) |
| ssdeep | 12288:IbjDhu9TaseNlEP959axuflmi/fLCwQtvu:21eTaLNmD9axuf/LZ |
| Threatray | 72 similar samples on MalwareBazaar |
| TLSH | T14EA4F16AB2E41095DBF641F2D4911706EA70B4721B2573CF2BA453771B2B8CA9F3D3A0 |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup_x86_x64_install.exe
Verdict:
Malicious activity
Analysis date:
2021-10-06 23:04:16 UTC
Tags:
trojan rat redline loader stealer vidar evasion ficker opendir
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the Windows subdirectories
Deleting a recently created file
Replacing files
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
45 / 100
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected BatToExe compiled binary
Behaviour
Behavior Graph:
Threat name:
Win64.Trojan.Sabsik
Status:
Malicious
First seen:
2021-10-06 19:43:50 UTC
AV detection:
17 of 45 (37.78%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 62 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
suricata upx
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
UPX packed file
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
Unpacked files
SH256 hash:
8d9ed28e4ff869fb32f2f4a97c12d40c43942e72a31e9c14c3ce6ddfa0eb63be
MD5 hash:
7d490b957c53094cb972141b082c0b41
SHA1 hash:
40acca2f51a9f40ed4e671ebcbd0233c4149dc08
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 8d9ed28e4ff869fb32f2f4a97c12d40c43942e72a31e9c14c3ce6ddfa0eb63be
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.