MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 933a1cf751dbe91f37eff4989a48a12c3e1b2ebfb3a7e4d10520e6653c3e1a27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 933a1cf751dbe91f37eff4989a48a12c3e1b2ebfb3a7e4d10520e6653c3e1a27
SHA3-384 hash: e866758a5a47f020bcded4d4d976ff260f8bc596c7873f4f43a0b3a02fae51e6379f381d8d4413a3524c56ba19cf8b27
SHA1 hash: a770467047604e8d3702baa465a07695c7af2ac7
MD5 hash: b3b521bb7ff5e6e6631057aedff87acd
humanhash: emma-venus-muppet-network
File name:ga5l20l0cczl3b4.dll
Download: download sample
File size:11'776 bytes
First seen:2021-02-24 06:23:58 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f78641fe95083901584730999cd8bd72
ssdeep 192:F8gtM7u7cUHXPre6rQUaTy8umkicqTcZQiYXjZdtPGDroTg:FJbHfrNkFujHNYTEDug
TLSH 3A328F372313D476DD424E7409198039A3A7FE4931155A030EB64CD74EE5AB7B838748
Reporter fabjer
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118791/
Detection(s):
SecuriteInfo.com.W32.AIDetectGBM.malware.01.31180.22273.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/616141
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/933a1cf751dbe91f37eff4989a48a12c3e1b2ebfb3a7e4d10520e6653c3e1a27/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-24 06:24:07 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  1/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210224-35jeqcwqjn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
933a1cf751dbe91f37eff4989a48a12c3e1b2ebfb3a7e4d10520e6653c3e1a27
MD5 hash:
b3b521bb7ff5e6e6631057aedff87acd
SHA1 hash:
a770467047604e8d3702baa465a07695c7af2ac7
Link:
https://www.unpac.me/results/496ba4d3-9b43-4712-a0a0-cb75eee32edb/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 1b3f97b6b5e4553840b55eacf4c1de1746528a33bd7fcda33670d07d36baf9a1

DLL dll 933a1cf751dbe91f37eff4989a48a12c3e1b2ebfb3a7e4d10520e6653c3e1a27

(this sample)

  
Dropped by
SHA256 1b3f97b6b5e4553840b55eacf4c1de1746528a33bd7fcda33670d07d36baf9a1
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/118791/

Comments