MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 99d9fe42d05e4c368933ec8586627943545b16598a6112e45c01c5552e68ab20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 99d9fe42d05e4c368933ec8586627943545b16598a6112e45c01c5552e68ab20 |
|---|---|
| SHA3-384 hash: | fa2f2b2d06a65703b37956d54fde7b2d2806e16562dd0e4344a5b37271adf0dba2f4b575f04d7aabbabf80e27d0a635b |
| SHA1 hash: | 6c583b5f90de2f022b0065b3fd31e11ef026f4dc |
| MD5 hash: | 0cd5de3553c1c5cc94a2fa1b00385753 |
| humanhash: | arizona-august-high-ack |
| File name: | 99d9fe42d05e4c368933ec8586627943545b16598a6112e45c01c5552e68ab20.bin |
| Download: | download sample |
| File size: | 4'433'920 bytes |
| First seen: | 2022-01-27 22:37:26 UTC |
| Last seen: | 2022-01-28 00:59:49 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 98304:TJNuqLOM3S2cnG0b6t8YAOM3S2cnG0b6BeSe5KlSH:CqEIMufIMRSYH |
| Threatray | 1'752 similar samples on MalwareBazaar |
| TLSH | T14226D04337E4CA87E46C43B9B82282980FB5D208FB87F7BB1A7029DD2D513674D1A597 |
| Reporter |  unidentified0xc |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
DNS request
Сreating synchronization primitives
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe greyware obfuscated packed replace.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Lazy
Status:
Malicious
First seen:
2022-01-27 22:30:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
117
AV detection:
11 of 28 (39.29%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 1'742 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
6ac6cf482f3347d9df170f71d24b3cabbdf864377fab1b7e1c9007512c4c8f0d
MD5 hash:
1c6463f985ab0e3fbd39077d359e833a
SHA1 hash:
f074f007d53440d60febae2b678b13adcac50e2f
SH256 hash:
e9011d9fed685da012d9f5baee15872805e52bf73e2b8aa06b2792d20370d653
MD5 hash:
3103fe8ace86424086d97285f12af135
SHA1 hash:
741b237c0fa0098ef3aad6b6b48e7a377afff621
SH256 hash:
5ac962a9121ef7ab0f479e647961f3e2ca086e3cb306a47b8e3dc3f72e669842
MD5 hash:
ee9562fa37c96db8e0f73970c91a3c85
SHA1 hash:
7196b61919bc7c304bdea78a6c2912668033b30b
SH256 hash:
48541be9ed6be56e4ee61dd48ce6b237b7a83a3be4db5a54ce350a042c77ecfe
MD5 hash:
e6b8735ea19da68d9baa23f945a6fad3
SHA1 hash:
65ae6742bf4106ce56d57d3ab427bd3e379f9ca3
SH256 hash:
f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 hash:
2ecb51ab00c5f340380ecf849291dbcf
SHA1 hash:
1a4dffbce2a4ce65495ed79eab42a4da3b660931
SH256 hash:
99d9fe42d05e4c368933ec8586627943545b16598a6112e45c01c5552e68ab20
MD5 hash:
0cd5de3553c1c5cc94a2fa1b00385753
SHA1 hash:
6c583b5f90de2f022b0065b3fd31e11ef026f4dc
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_DotNET_Encrypted |
|---|---|
| Author: | ditekSHen |
| Description: | Detects encrypted or obfuscated .NET executables |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.