MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b99e0b750b3815fec3b292ede3f94524c8bede7d158334295e096518e9cde0ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Hakbit

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	b99e0b750b3815fec3b292ede3f94524c8bede7d158334295e096518e9cde0ad
SHA3-384 hash:	ee96f4b7923adc7a60fab62d1fdd53e413893e1a8aa57260b38f2f49cae9cc63fd6d778c6bcdc6f362f2a9b17215349a
SHA1 hash:	b7f33bd8aeb6cdd59cbf88802938c6efc0108829
MD5 hash:	d5edd6b32296d1cee4829fb1499c8759
humanhash:	maine-lake-hot-fifteen
File name:	8.exe
Download:	download sample
Signature	Hakbit Create hunting rule
File size:	63'488 bytes
First seen:	2020-04-14 23:18:14 UTC
Last seen:	2021-03-23 18:12:01 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	768:pq0j4UYPXiR420lM0XGYoZ78VeVgNwUQXyakNugHFMED/rD7KfqAPHDOlO1ndRHr:ZJYqR48YoGVeGLIQM5I2ZSbBT6o6
Threatray	16 similar samples on MalwareBazaar
TLSH	B7533904978A4F66F7DF83F4A4A60B04F270F8EA4676E38A1F9558F72D557E1820C4E2
Reporter	Jirehlov
Tags:	exe Hakbit

Intelligence

File Origin

# of uploads :

# of downloads :

1'865

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.DownLoader33.27839.20793.30003.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Filecoder

Status:

Malicious

First seen:

2020-04-05 22:36:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

33 of 45 (73.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xgpaw5ilhak75q5sslw6h6kfetel5xt5cwbtikk6bfsrr2on4cwq._file

Verdict:

suspicious

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample