MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b6f475e67a133bbd6806456ddedbc24f3588c4dea8d64df5058d8ccf37358ba9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | b6f475e67a133bbd6806456ddedbc24f3588c4dea8d64df5058d8ccf37358ba9 |
|---|---|
| SHA3-384 hash: | a2707f16a51d6893bf7fbe21c72839dd94c7e901157c1068801084cda8112127aad19a7d1e0060c3dc219519a67816b5 |
| SHA1 hash: | 6ee2540667535ce4d2735a795ebb191c1261b874 |
| MD5 hash: | f6dfe8a78bc6651d4fa2153063656ffb |
| humanhash: | emma-solar-idaho-venus |
| File name: | f6dfe8a78bc6651d4fa2153063656ffb.exe |
| Download: | download sample |
| File size: | 146'929 bytes |
| First seen: | 2023-02-28 08:51:47 UTC |
| Last seen: | 2023-02-28 10:34:34 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c702649e211ff4e9af2e81908e0fc8b8 (4 x Smoke Loader, 3 x RedLineStealer, 2 x CoinMiner) |
| ssdeep | 3072:NELKOTCJeuGsIdhn9I+Xm2I+nSvLbTPxe9kZPGv:qHTCwuGVnn9IpekbTPs9kK |
| TLSH | T16AE3D021B790C071D49722305974D6B09EBA7DA253B1898F77940B3F4F603D16EF63AA |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
5/10
Confidence:
67%
Tags:
greyware overlay packed shell32.dll
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Vidar
Status:
Malicious
First seen:
2023-02-27 16:26:48 UTC
File Type:
PE (Exe)
AV detection:
13 of 25 (52.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Unpacked files
SH256 hash:
b6f475e67a133bbd6806456ddedbc24f3588c4dea8d64df5058d8ccf37358ba9
MD5 hash:
f6dfe8a78bc6651d4fa2153063656ffb
SHA1 hash:
6ee2540667535ce4d2735a795ebb191c1261b874
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe b6f475e67a133bbd6806456ddedbc24f3588c4dea8d64df5058d8ccf37358ba9
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.