MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 930328b4d0e869b7d6eec8b250366523258c33c121a8515d3a78fe8d6c8c9fc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 930328b4d0e869b7d6eec8b250366523258c33c121a8515d3a78fe8d6c8c9fc1 |
|---|---|
| SHA3-384 hash: | b1ec3065bb10881f665391fbd77efcfb1e6017063d4bcb86e181472ad796c0daa7bd38c622801f20399b7fe1cac123b8 |
| SHA1 hash: | 7c9fcee16ca3b81a35782be843406cecb803f448 |
| MD5 hash: | a4d789c995239985f1fc547b8cd64c32 |
| humanhash: | vegan-illinois-thirteen-mobile |
| File name: | Billing Details.cmd |
| Download: | download sample |
| File size: | 544'768 bytes |
| First seen: | 2021-02-23 07:15:28 UTC |
| Last seen: | 2021-02-23 08:46:08 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7ce95782f94d8c06a522ef2ce68f3fe9 |
| ssdeep | 12288:mJZJpZFS02A46A9jmP/uhu/yMS08CkntxYRo:mJZ7ZFizfmP/UDMS08Ckn3V |
| Threatray | 4'839 similar samples on MalwareBazaar |
| TLSH | 46C48D17EB10F10AE452C8B02965929B67397D321280AE03F7C16F5AA6726D7BCF570F |
| Reporter |  abuse_ch |
| Tags: | cmd |
abuse_ch
Malspam distributing unidentified malware:HELO: pro.mxout.rediffmailpro.com
Sending IP: 119.252.152.37
From: corporate@acrossbroking.com <corporate@acrossbroking.com>
Subject: Payment for BILL 051-2020 Has Been Sent
Attachment: Billing_Details.zip (contains "Billing Details.cmd")
Intelligence
File Origin
# of uploads :
2
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Running batch commands
Creating a process with a hidden window
Creating a file
Searching for the window
Deleting a recently created file
Replacing files
Launching a process
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
68 / 100
Signature
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Yara detected VB_Keylogger_Generic
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Graftor
Status:
Malicious
First seen:
2021-02-23 01:14:42 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 4'829 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
4/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Unpacked files
SH256 hash:
930328b4d0e869b7d6eec8b250366523258c33c121a8515d3a78fe8d6c8c9fc1
MD5 hash:
a4d789c995239985f1fc547b8cd64c32
SHA1 hash:
7c9fcee16ca3b81a35782be843406cecb803f448
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 930328b4d0e869b7d6eec8b250366523258c33c121a8515d3a78fe8d6c8c9fc1
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.