MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 98bd4ef353739dc8198b8c460c5bfb82b412e57d3db1f3180f8f5bf6d3b4a197. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 15
| SHA256 hash: | 98bd4ef353739dc8198b8c460c5bfb82b412e57d3db1f3180f8f5bf6d3b4a197 |
|---|---|
| SHA3-384 hash: | 2087c7971d029f78c0a0ae7e645971dd86a9f06b99eb134b060439e6a55c128af70fabdecea54f30c2eaa5982b3fe94d |
| SHA1 hash: | 701fb89bfaf393706067345da1bc683908771cb9 |
| MD5 hash: | 5b1e8546ee1f27c41e20343a17dd2c4e |
| humanhash: | victor-lamp-happy-london |
| File name: | 5b1e8546ee1f27c41e20343a17dd2c4e |
| Download: | download sample |
| File size: | 3'049'472 bytes |
| First seen: | 2024-08-05 16:35:52 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 49152:WMGelEbmKZgiHO5yMB3j5ozt8cDAp0OekFPm/vRPHdzx3nONo:yVkoztZGFPm/vR1N3nOK |
| TLSH | T172E502CC1BE42A16E2EEC777CCE159A2C778E051E79AF30E148582A91C09F969C51F4F |
| TrID | 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.8% (.SCR) Windows screen saver (13097/50/3) 8.7% (.EXE) Win64 Executable (generic) (10523/12/4) 5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
339
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5b1e8546ee1f27c41e20343a17dd2c4e
Verdict:
Malicious activity
Analysis date:
2024-08-05 16:37:36 UTC
Tags:
crypto-regex netreactor
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
92.5%
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Launching a process
Creating a process with a hidden window
Сreating synchronization primitives
Creating a window
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
macros-on-open obfuscated packed packed smartassembly smart_assembly
Verdict:
Malicious
Labled as:
Malware
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
92 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Nekark
Status:
Malicious
First seen:
2024-08-05 15:38:55 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
15 of 24 (62.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Result
Malware family:
n/a
Score:
5/10
Tags:
discovery
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
ab608b348bdf5fac904bd24ed9e5814cc7676adcdd19e12618e9ed8f2b1c4e59
MD5 hash:
ee20813eb668db8d442859ca97e26c3b
SHA1 hash:
cd9ad3d23f3340b041d46f6ed30d6b42106e081e
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
6ddc603fd73ebbdf5dea636eab8b02aff193880bddc02cbdd764e111814531e4
MD5 hash:
4f03f1022748fcb0b119f0c0ce1faf23
SHA1 hash:
3e83d6cf38db2577b40cef1041958981c53a00a7
SH256 hash:
d51fff3aa2b5aaa16b185143cc51293eb774ba131d8435170cfae96117d41e97
MD5 hash:
b82b4a4c09dc237ef81996b92e905a9e
SHA1 hash:
f8b8bb849a526e0920d8fe0c39b335022aa33210
SH256 hash:
1086426c0b8731324acd12c4c8eb5ecd76b4096a6acd3db141cf06dc5027ae3e
MD5 hash:
1ed91d4705ad029bf62b68dba0735878
SHA1 hash:
d28bb834b6c9f675e8088c10ea6a9e1662856893
SH256 hash:
d316403a42ccdfd7e424b02a26f7ed9da1e107961168bc4fd9ffbcf6ca6f4190
MD5 hash:
bb907fd201e263e78ebe3dad58411174
SHA1 hash:
9197d082b74de2173256f880cf974eca01e48c9d
SH256 hash:
41ad35fa12d9b98e203067c6b61115dc93e3a239f896f4cb05471efbaac46565
MD5 hash:
436c039c7ba09543480f8c28fc1eb5a1
SHA1 hash:
4715be17804c19eb99999231a739835161c13111
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
SH256 hash:
109aca9f9cc98b27204830b210bade9e5a7271bf77ead36a39af24cb30d8ec25
MD5 hash:
9d81209284740e4a6221c3a25c9a262b
SHA1 hash:
1d35ee1d63f9589ad4f983b0b22d89f63448053b
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
98bd4ef353739dc8198b8c460c5bfb82b412e57d3db1f3180f8f5bf6d3b4a197
MD5 hash:
5b1e8546ee1f27c41e20343a17dd2c4e
SHA1 hash:
701fb89bfaf393706067345da1bc683908771cb9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_SmartAssembly |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with SmartAssembly |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 98bd4ef353739dc8198b8c460c5bfb82b412e57d3db1f3180f8f5bf6d3b4a197
(this sample)
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://45.131.66.20/skx111.exe