MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa2d310bf44acf203cccd07a1c5bf4ed70b9b57e33453ad355b7c50dc687a37d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa2d310bf44acf203cccd07a1c5bf4ed70b9b57e33453ad355b7c50dc687a37d
SHA3-384 hash: c26f2ec88423235a32aca3c943e2111fe82f06f5242c0c21c1c142c21e06cab4d9a38d3f70f7d1f0cf904f6ad1d360ec
SHA1 hash: b527d1e726ccdb553e88673152305a4f3935dde6
MD5 hash: 7254cd8b0045dd84a5d484e167886fc9
humanhash: vermont-alpha-nitrogen-quebec
File name:7254cd8b0045dd84a5d484e167886fc9.exe
Download: download sample
File size:4'097'071 bytes
First seen:2022-03-29 07:38:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:LNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3q:JzP88fBsnZTgOtqB3m1RC3q
TLSH T11416AD12BBD58F2BC5564B388AE783647379DC904B43575BA38A712D3DB23E02B871D8
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/259032/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader32.48498.2065.27227.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6242b79c9253b276b7992798/reports/2a3f3844-278c-4d4a-8e10-b4a4d51c1ee1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1bda119c-ac5f-4e68-864a-1e657e97c72c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
mine
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/967250
Signature
Found strings related to Crypto-Mining
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa2d310bf44acf203cccd07a1c5bf4ed70b9b57e33453ad355b7c50dc687a37d/
Threat name:
Win32.Trojan.Miner
Create hunting rule
Status:
Malicious
First seen:
2022-03-28 16:27:42 UTC
File Type:
PE (Exe)
AV detection:
11 of 42 (26.19%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220329-jgyqwsggel/
Unpacked files
SH256 hash:
aa2d310bf44acf203cccd07a1c5bf4ed70b9b57e33453ad355b7c50dc687a37d
MD5 hash:
7254cd8b0045dd84a5d484e167886fc9
SHA1 hash:
b527d1e726ccdb553e88673152305a4f3935dde6
Link:
https://www.unpac.me/results/7218a36f-4f7a-4762-a13a-78359a050f5f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/aa2d310bf44acf203cccd07a1c5bf4ed70b9b57e33453ad355b7c50dc687a37d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe aa2d310bf44acf203cccd07a1c5bf4ed70b9b57e33453ad355b7c50dc687a37d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2111816/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/259032/

Comments