MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 aa3b1c5afc0e923ac0a9dc5e17022e89a4df64403ac57bc7f53058acf8ada2aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | aa3b1c5afc0e923ac0a9dc5e17022e89a4df64403ac57bc7f53058acf8ada2aa |
|---|---|
| SHA3-384 hash: | 49a73fb6d8bff9952c5ded19afdab112ea7c780bff037817f92f840c5ceae668fefba0515e8242979510efb03d4db96a |
| SHA1 hash: | 728618a5b3cbe492f94fe55884391827874e8e4c |
| MD5 hash: | 0c890d36918164e6fe9b78788fbc128d |
| humanhash: | mississippi-happy-burger-juliet |
| File name: | 0c890d36918164e6fe9b78788fbc128d |
| Download: | download sample |
| File size: | 1'187'187 bytes |
| First seen: | 2021-07-03 10:47:30 UTC |
| Last seen: | 2021-07-03 11:39:43 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | e04eb610508ddb951732064297e50b65 (6 x CryptBot) |
| ssdeep | 24576:j/T4vHsNMXj2mutmW8hi455JZYkO73VM+0X8T:jbkM2Xj2mu1oiEej7Fr0XW |
| TLSH | D9459D0095C9E8A9C01A1032943DB53924D9F6DBD27BCC9FEB5C660964AF3D2E17BE0D |
| Reporter |  zbetcheckin |
| Tags: | 32 exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0c890d36918164e6fe9b78788fbc128d
Verdict:
Malicious activity
Analysis date:
2021-07-03 10:51:07 UTC
Tags:
autoit trojan 1xxbot
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
81 / 100
Signature
.NET source code contains very large array initializations
Contains functionality to register a low level keyboard hook
Creates processes via WMI
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Submitted sample is a known malware sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Crypzip
Status:
Malicious
First seen:
2021-07-03 10:48:10 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
5/5
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops startup file
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
5e3e4ebd9c4ca827035498e4e4561d44577cb7f5384ab8763ae2cbbf3f78fb82
MD5 hash:
6f131615ec1ee1acb03e6756379b2d80
SHA1 hash:
b268312f837c0e0ef76017c9032f0b64a8d40353
SH256 hash:
aa3b1c5afc0e923ac0a9dc5e17022e89a4df64403ac57bc7f53058acf8ada2aa
MD5 hash:
0c890d36918164e6fe9b78788fbc128d
SHA1 hash:
728618a5b3cbe492f94fe55884391827874e8e4c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe aa3b1c5afc0e923ac0a9dc5e17022e89a4df64403ac57bc7f53058acf8ada2aa
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://136.144.41.201/USA/paypall.exe