MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a0aac3dc5832026a3d12d50f3c39e988a334d87ea2fc8fbcd1ff33484606d2d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 10
| SHA256 hash: | a0aac3dc5832026a3d12d50f3c39e988a334d87ea2fc8fbcd1ff33484606d2d3 |
|---|---|
| SHA3-384 hash: | 00db8c2eb7b3d409c661f411178f2006564b6a757b11bde75f98795b770dd0fe256ef0a9527eb9a8ea02d011e9f70e62 |
| SHA1 hash: | 9a33ae3a28d651aa20d7b34a94722a589a4035e5 |
| MD5 hash: | ee859aa695a1f7026610e139afaec6f1 |
| humanhash: | blossom-monkey-helium-berlin |
| File name: | PO 1002567005.....exe |
| Download: | download sample |
| File size: | 716'172 bytes |
| First seen: | 2022-10-10 06:11:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 56a78d55f3f7af51443e58e0ce2fb5f6 (739 x GuLoader, 453 x Formbook, 295 x Loki) |
| ssdeep | 12288:dNe1QFYm94oUhIH0DOjDO6D7zkoT+lqp/7Iu/O2ybZx9Y9rl7jjGHD:dNeu3TUG0KjDZlT+lQTD/O3BArRCHD |
| Threatray | 205 similar samples on MalwareBazaar |
| TLSH | T161E4227837418366EF639E39CB2F722D9AB58C6605D0E12ACB0EBFBC2CF55524D25244 |
| TrID | 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 125ad212e9cd3682 (40 x AgentTesla, 21 x Loki, 19 x Heodo) |
| Reporter |  adrian__luca |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
183
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
DNS request
Reading critical registry keys
Sending an HTTP GET request
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Leonem
Status:
Malicious
First seen:
2022-10-05 23:30:26 UTC
File Type:
PE (Exe)
Extracted files:
32
AV detection:
22 of 26 (84.62%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 195 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
c0e1bbe2304d89804673b63a17416041e299c2773aceec70759f1094829b189e
MD5 hash:
47c9aaa4eef6e3ace27ccbde29a5c848
SHA1 hash:
dfbc78c9b2ad768bb8946cd2d12e389258329a9f
SH256 hash:
595f8e51fbe326d278c78011343470ce97f5d655ad657023a4ba5edc79006a4d
MD5 hash:
afd61ed83d724ee7e4459b7526109c2f
SHA1 hash:
458f66512e5ba13b3777266528767935fa57028e
SH256 hash:
a0aac3dc5832026a3d12d50f3c39e988a334d87ea2fc8fbcd1ff33484606d2d3
MD5 hash:
ee859aa695a1f7026610e139afaec6f1
SHA1 hash:
9a33ae3a28d651aa20d7b34a94722a589a4035e5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe a0aac3dc5832026a3d12d50f3c39e988a334d87ea2fc8fbcd1ff33484606d2d3
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.