MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a108f3a5b8bb71cb0e4d49647a1b096d3bfff9c08b8252fa2b1dc16cb4c16d4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 10
| SHA256 hash: | a108f3a5b8bb71cb0e4d49647a1b096d3bfff9c08b8252fa2b1dc16cb4c16d4b |
|---|---|
| SHA3-384 hash: | 8c038c3c882b8af5ae3b09fe22ee57a6ae5adf0b2e20dcf5121b714a353dfe8f25f1150a58909d09c475ad98a87a6f5b |
| SHA1 hash: | a544db08dc437f53956ca2fb68ab634f9021112a |
| MD5 hash: | 3ba94fca6617eeaa79d0e074e0842118 |
| humanhash: | fish-johnny-helium-six |
| File name: | ECL_1060572_085700.exe |
| Download: | download sample |
| File size: | 934'912 bytes |
| First seen: | 2021-12-01 17:34:14 UTC |
| Last seen: | 2021-12-01 17:36:39 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:qGslY14B4lHdZcUqRdytFCtd6YJ1GRtr+2gNE8:h/+CHdNqRAtCm |
| Threatray | 4'801 similar samples on MalwareBazaar |
| TLSH | T16A15AFCEA6024409E908E771DD376B104F61FDA69910D247F3783F6BB43A6B93A91363 |
| File icon (PE): |  |
| dhash icon | 4730d8d4d4d830c7 (4 x NanoCore, 3 x SnakeKeylogger, 1 x BluStealer) |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
3
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ECL_1060572_085700.exe
Verdict:
Malicious activity
Analysis date:
2021-12-01 17:37:17 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
DNS request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
5/10
Confidence:
67%
Tags:
obfuscated packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-12-01 14:23:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
22 of 28 (78.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 4'791 additional samples on MalwareBazaar
Result
Malware family:
blustealer
Score:
10/10
Tags:
family:blustealer stealer
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
BluStealer
Unpacked files
SH256 hash:
185645f6e3fc9041c249588600d66353f559e098dbaecf84a7971881bcc323f6
MD5 hash:
1db27216007caf93621a83aaaced92d6
SHA1 hash:
c363d52e4f7fc0318d1bee6be8b31be1d61c2395
SH256 hash:
3018b8632d3ab247f47ddeb46f035b7522c47349d130935d0a1e8bdf8fd01fd1
MD5 hash:
47e99d9313cbb4951cf6e87cdbe4577e
SHA1 hash:
b6fba2685db45417d806fa1c0fa0f5133da7c5da
SH256 hash:
0d046cc424e134441fe28ceb660cd182c291efac011efbf001b518e6771ef6fc
MD5 hash:
6be26cfb0bc8d2c073e4f2cee658dc50
SHA1 hash:
a59b342fca957a16e85e8baced8b48cbe9b127b5
SH256 hash:
5f2d2865b6f9b176d8a6506871a25d998de642bc9c77c97714e7a157999f8459
MD5 hash:
c3628f7690fec4621d9fad92dc23635f
SHA1 hash:
6a92e84eee2d0cbdb1372cf4af0e7bb66385dec8
SH256 hash:
50cf53c4e2097dd8eba4bc2840c7c74bc13082150a418d130ebe4ebfc04a858d
MD5 hash:
b9542da0a4f3e9c0110d15f5ff904b49
SHA1 hash:
08b08389f9d640c564ea49e9d394e452372f43f6
SH256 hash:
a108f3a5b8bb71cb0e4d49647a1b096d3bfff9c08b8252fa2b1dc16cb4c16d4b
MD5 hash:
3ba94fca6617eeaa79d0e074e0842118
SHA1 hash:
a544db08dc437f53956ca2fb68ab634f9021112a
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture |
|---|---|
| Author: | ditekSHen |
| Description: | Detect executables with stomped PE compilation timestamp that is greater than local current time |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Typical_Malware_String_Transforms |
|---|---|
| Author: | Florian Roth |
| Description: | Detects typical strings in a reversed or otherwise modified form |
| Reference: | Internal Research |
| Rule name: | Typical_Malware_String_Transforms_RID3473 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects typical strings in a reversed or otherwise modified form |
| Reference: | Internal Research |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe a108f3a5b8bb71cb0e4d49647a1b096d3bfff9c08b8252fa2b1dc16cb4c16d4b
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.