MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9e0d8b40ee55e5b66d3b79984a66bdaf38ba2c1cb33c8d88f5b504f8e31ed421. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | 9e0d8b40ee55e5b66d3b79984a66bdaf38ba2c1cb33c8d88f5b504f8e31ed421 |
|---|---|
| SHA3-384 hash: | 76f7dde4e267d1ec9fb8c22928e8300b4bc4487b7d5d9b427e69731720d1efdca121d78ee990c7bd155c359a6b7f1af5 |
| SHA1 hash: | 4767d63a2ecd64647f788df36d89317d371920d3 |
| MD5 hash: | 546740b19df0f9b9390e0c25e6cab784 |
| humanhash: | pizza-michigan-east-purple |
| File name: | a18f3c7892a2403bf917156c3d39aca4 |
| Download: | download sample |
| File size: | 212'992 bytes |
| First seen: | 2020-11-17 11:54:24 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 03ae0108c7455c49c94d2d60afa1e57a (1 x Worm.Ramnit) |
| ssdeep | 3072:FyBssVjZVznsLBDzUXH7myDtH7HsUj/N4O+0EOFZ3E1z5tBrJ/4pLthEjQT6j:FyK+LsFapjKO76BrFkEj1 |
| Threatray | 129 similar samples on MalwareBazaar |
| TLSH | 74248D4173D1F421C17727B48EDED7E52B247D22DFF6A70BB68ABBAD9E342450820A11 |
| Reporter |  seifreed |
Intelligence
File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the Windows subdirectories
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Threat name:
Win32.Trojan.Aenjaris
Status:
Malicious
First seen:
2020-11-17 11:57:14 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 119 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
9/10
Tags:
persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
ServiceHost packer
Unpacked files
SH256 hash:
9e0d8b40ee55e5b66d3b79984a66bdaf38ba2c1cb33c8d88f5b504f8e31ed421
MD5 hash:
546740b19df0f9b9390e0c25e6cab784
SHA1 hash:
4767d63a2ecd64647f788df36d89317d371920d3
SH256 hash:
160e0cb8b8314c753497c9134f4370b7f43ba1fb34477fb42ff4dde9497eb029
MD5 hash:
ee6b4fd8c71a1b40b5ef93fd3b60242f
SHA1 hash:
7db2bfd502fe49a084e86d4d8a02c862f177ac41
SH256 hash:
e01199e4b70e6b88131942bb170f58ba17c8cc7cd34ca69cb2768992aadb47e1
MD5 hash:
a346ac6bb0591b007c0d0e63e036f99b
SHA1 hash:
b1f91c0fc464c5ab69530b735b78effe1d1e7161
SH256 hash:
7bd05d7c8153369d0d73ccd64bb3265e86f7ebc6860757544706638279326c5d
MD5 hash:
60ebbbcaa51d6b244d770d168c46f245
SHA1 hash:
4b532e14e3b4e3bfd8946059a17ae46e82fa4e96
SH256 hash:
296f4ab0a279743695bff33849e478aa92c3a03b198f1c15ffa7a099ef547045
MD5 hash:
9c641db48b150feac90ba57d64ca6b15
SHA1 hash:
270a73166deeee73d63f36725db338278098552d
SH256 hash:
15152dca99a73cdcb38cb7307fb48087b9c8ebd197c3a6b2444bc3c7626496f4
MD5 hash:
d1b27df75507f32898ba6736a4472673
SHA1 hash:
7c1134509467afc41da1832be422daccfa0f43dc
SH256 hash:
8057977c735f3516344611bc44672c4aedcfd1a886e7dcb45a449034a2ad896f
MD5 hash:
4cd08520f9f04f917694100d97b4af78
SHA1 hash:
511e904ace9b815b2a93d04a830e1892d57ea976
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.