MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 11
| SHA256 hash: | 938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97 |
|---|---|
| SHA3-384 hash: | 90b4f82abad8b5c7cf9dae7449f01f221365720a3ebcfac9e0a6c9c3060316b9a3b97dc777f8d496cbd30735f4707c87 |
| SHA1 hash: | 98d1ceaf325f590999ce53677bf8bd47b2dbb0da |
| MD5 hash: | 4fae07b21b2ce5aa949208dd0540b768 |
| humanhash: | tango-mango-nine-berlin |
| File name: | 4fae07b21b2ce5aa949208dd0540b768 |
| Download: | download sample |
| File size: | 2'130'121 bytes |
| First seen: | 2022-05-11 07:29:28 UTC |
| Last seen: | 2022-05-11 08:40:08 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ab9ff6e4872ea2766a5f5c6af5649e9d (20 x CryptOne, 13 x RedLineStealer, 6 x RecordBreaker) |
| ssdeep | 24576:gJr8tE+gHqcgrTceagQEIYu4//aw0zQI029wYk+BoFJjuMXG8Iva4A4S:gJ4NiDtlmnawuZ029wYijuRI4S |
| Threatray | 85 similar samples on MalwareBazaar |
| TLSH | T169A52409A147E27BFCEC18E3055090D0D29C7FAA7B528CCDE93AC686551F482F7B6D86 |
| TrID | 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13) |
| File icon (PE): |  |
| dhash icon | 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
410
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
greyware overlay qakbot setupapi.dll shdocvw.dll shell32.dll update.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Ransomware.CerberCrypt
Status:
Malicious
First seen:
2022-05-11 07:39:49 UTC
AV detection:
15 of 26 (57.69%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 75 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97
MD5 hash:
4fae07b21b2ce5aa949208dd0540b768
SHA1 hash:
98d1ceaf325f590999ce53677bf8bd47b2dbb0da
Malware family:
CryptOne
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://premiumfilehosting.com/search_hyperfs_213.exe