MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 955c1ef7a0bdd5aec06a9cd1e42fc4542ce1ce819a62d233327a3c964043e52a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 955c1ef7a0bdd5aec06a9cd1e42fc4542ce1ce819a62d233327a3c964043e52a |
|---|---|
| SHA3-384 hash: | 0bf66a8a1ccade7cd3af2e3130c97f18b4ce4ed1d10894702606d58e678545f2a2d8423411ac0ee43b6f51d60143aa23 |
| SHA1 hash: | f257677293d086a6f174f896015c70d144b6427d |
| MD5 hash: | fd32312fa875278f76fdce036347917a |
| humanhash: | fish-romeo-nine-cup |
| File name: | SecuriteInfo.com.Trojan.GenericKD.44192058.22260.12771 |
| Download: | download sample |
| File size: | 3'039'720 bytes |
| First seen: | 2021-01-07 13:24:41 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 20dd26497880c05caed9305b3c8b9109 (31 x Adware.Auslogics, 5 x Adware.IObit, 5 x LummaStealer) |
| ssdeep | 49152:qvAMxcldmTSaWTfJoZfwcOCRKFYC4Wn9cJTtmr55Oiwut7tLzj227BOTc7qW:XMxciJSCOKBTYrLOvM9zC27v7v |
| Threatray | 1 similar samples on MalwareBazaar |
| TLSH | 7CE51296BF4218F5DC2128F8C90788545E62FD7A58F260523CFEF33E0AB75828535A97 |
| Reporter |  SecuriteInfoCom |
Intelligence
File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.GenericKD.44192058.22260.12771
Verdict:
Suspicious activity
Analysis date:
2021-01-07 13:27:55 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
24 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-23 12:53:26 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
955c1ef7a0bdd5aec06a9cd1e42fc4542ce1ce819a62d233327a3c964043e52a
MD5 hash:
fd32312fa875278f76fdce036347917a
SHA1 hash:
f257677293d086a6f174f896015c70d144b6427d
SH256 hash:
03bfdca104372e371e385e8886546e2d139cddd75adb4f48833f470a07fcf03b
MD5 hash:
a68b2f066c9ce544fab35ca9cc4deb68
SHA1 hash:
207d461c2bdfeafeb2b151a27e3e2295cf016cd3
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 955c1ef7a0bdd5aec06a9cd1e42fc4542ce1ce819a62d233327a3c964043e52a
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.