MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 aaf6bf718709c45dda9fc1d5f0d1656702ff664b8c8b202b381db4044efa6455. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | aaf6bf718709c45dda9fc1d5f0d1656702ff664b8c8b202b381db4044efa6455 |
|---|---|
| SHA3-384 hash: | ef80576561a6fc44c1fd23ba2db2ecba35955b470070067f1d20fc843c55c5b879347d54fbaffb23213af900249f0725 |
| SHA1 hash: | bdc7af5cf562dda41a9286be4d3b1f12144d6daf |
| MD5 hash: | 463145f8936c7e86a5d3345761bc6d65 |
| humanhash: | maryland-king-tennis-bacon |
| File name: | 463145f8936c7e86a5d3345761bc6d65.exe |
| Download: | download sample |
| File size: | 6'724'096 bytes |
| First seen: | 2023-07-20 06:58:26 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ea2d297e3bd3b5b7def0556d0ff46651 (1 x AsyncRAT, 1 x LummaStealer, 1 x RedLineStealer) |
| ssdeep | 196608:At2jMGFaPKF6vRcWFPaH162uTql2iXq8gxcS:AUjw5+WFS162uTql2qvgxv |
| Threatray | 3 similar samples on MalwareBazaar |
| TLSH | T10566230139C0C076C6772032066AF3B29ABFF4751B2552DF67A41A7E6F306C19B3676A |
| TrID | 32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13) |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
238
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
463145f8936c7e86a5d3345761bc6d65.exe
Verdict:
Malicious activity
Analysis date:
2023-07-20 06:58:56 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
control greyware lolbin packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
80 / 100
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Writes to foreign memory regions
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Smokeloader
Status:
Suspicious
First seen:
2023-07-20 06:59:07 UTC
File Type:
PE (Exe)
AV detection:
20 of 25 (80.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
0926097d5ae2e323a89bdf147adf88b57e640dd3083b4a59687575ed06fba520
MD5 hash:
8fe1e6daab4f9b5470b5e70741ade72b
SHA1 hash:
b651051153e3eaff360b0843fb4922d482dffe85
SH256 hash:
aaf6bf718709c45dda9fc1d5f0d1656702ff664b8c8b202b381db4044efa6455
MD5 hash:
463145f8936c7e86a5d3345761bc6d65
SHA1 hash:
bdc7af5cf562dda41a9286be4d3b1f12144d6daf
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.