MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bc237ec67a9a6e358ecb5b4625e456ab55b6242359e0e04f379a82ba83004454. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
N-W0rm
Vendor detections: 10
| SHA256 hash: | bc237ec67a9a6e358ecb5b4625e456ab55b6242359e0e04f379a82ba83004454 |
|---|---|
| SHA3-384 hash: | a16f9f8bd878e637e97e66c649093f56c5912997815eaa57a742dba1f38a44ab6ed5d957c47665128967ea4ca6fadf49 |
| SHA1 hash: | b7a6a91034484e177df6429325f875857f6f0323 |
| MD5 hash: | f31a6fdf5a1c4ef0ca3eefe3e6886688 |
| humanhash: | nineteen-indigo-west-apart |
| File name: | Purchase Inquiry.exe |
| Download: | download sample |
| Signature | N-W0rm |
| File size: | 1'133'056 bytes |
| First seen: | 2023-06-26 21:45:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'471 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:15dPG2f3+o+lrE8y5vD1DU/ESdb2JAfFrZ/07pC5E9LKRslDL3AQgYhTI29HAuZd:r3Ber/07g5ERaqDLwERdAujz7VvZQs |
| Threatray | 2'194 similar samples on MalwareBazaar |
| TLSH | T16A35AC3939BC5627D170D7E38FE7F423F2B8982B3021DA2558D657D9468AB1225C323E |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | exe N-W0rm |
Intelligence
File Origin
# of uploads :
1
# of downloads :
321
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase Inquiry.exe
Verdict:
Malicious activity
Analysis date:
2023-06-26 21:48:21 UTC
Tags:
zgrat
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
masquerade packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code contains very large strings
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Taskun
Status:
Malicious
First seen:
2023-06-26 10:41:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
18 of 24 (75.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 2'184 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
cda0bdcbd5b63706753534bb3a5099e52751a6df80764cba7200f2aac6c0899a
MD5 hash:
e2fc4441122d134574147c332ca79e9f
SHA1 hash:
84177209c5d2f84f0290ecda851ba573c2d795f3
SH256 hash:
3ee6b2e12f816a3fd42dab31905ed04c3d219887f1e37f0fa2987b5402f00366
MD5 hash:
a1c4aebc2be356fed684292874cab02b
SHA1 hash:
5b5d03ee8e39694f9fb55818b6eedfcfda6c4b63
SH256 hash:
3d2b3fac65d44cca8f0e5c4620053d51e9bc6bd47ec5926de8f96ec13c491924
MD5 hash:
f56ebf4021ee8eebca5d94c3da82be3a
SHA1 hash:
0d22c97588e3043d5197045255d1240bf9d3536d
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
SH256 hash:
bcc055cb4c2ed40dd497f51a187ef1a271f2ff003df2a934b01e84ce391d8057
MD5 hash:
b3abc9bcb5b5c1eea61e7afea4459326
SHA1 hash:
108036f7cecc83119a5cadb154321a92fdf70c9f
SH256 hash:
9cb9f3549cbb7ab95699b23036f604b74677075ceb6be7918a3d97c22ed914ff
MD5 hash:
69f7b44ad7a90e2cef90db674a9424e8
SHA1 hash:
0ad9a90c898646dfb3568c128996f9c5b18d10e0
SH256 hash:
cda0bdcbd5b63706753534bb3a5099e52751a6df80764cba7200f2aac6c0899a
MD5 hash:
e2fc4441122d134574147c332ca79e9f
SHA1 hash:
84177209c5d2f84f0290ecda851ba573c2d795f3
SH256 hash:
3ee6b2e12f816a3fd42dab31905ed04c3d219887f1e37f0fa2987b5402f00366
MD5 hash:
a1c4aebc2be356fed684292874cab02b
SHA1 hash:
5b5d03ee8e39694f9fb55818b6eedfcfda6c4b63
SH256 hash:
3d2b3fac65d44cca8f0e5c4620053d51e9bc6bd47ec5926de8f96ec13c491924
MD5 hash:
f56ebf4021ee8eebca5d94c3da82be3a
SHA1 hash:
0d22c97588e3043d5197045255d1240bf9d3536d
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
SH256 hash:
bcc055cb4c2ed40dd497f51a187ef1a271f2ff003df2a934b01e84ce391d8057
MD5 hash:
b3abc9bcb5b5c1eea61e7afea4459326
SHA1 hash:
108036f7cecc83119a5cadb154321a92fdf70c9f
SH256 hash:
9cb9f3549cbb7ab95699b23036f604b74677075ceb6be7918a3d97c22ed914ff
MD5 hash:
69f7b44ad7a90e2cef90db674a9424e8
SHA1 hash:
0ad9a90c898646dfb3568c128996f9c5b18d10e0
SH256 hash:
cda0bdcbd5b63706753534bb3a5099e52751a6df80764cba7200f2aac6c0899a
MD5 hash:
e2fc4441122d134574147c332ca79e9f
SHA1 hash:
84177209c5d2f84f0290ecda851ba573c2d795f3
SH256 hash:
3ee6b2e12f816a3fd42dab31905ed04c3d219887f1e37f0fa2987b5402f00366
MD5 hash:
a1c4aebc2be356fed684292874cab02b
SHA1 hash:
5b5d03ee8e39694f9fb55818b6eedfcfda6c4b63
SH256 hash:
3d2b3fac65d44cca8f0e5c4620053d51e9bc6bd47ec5926de8f96ec13c491924
MD5 hash:
f56ebf4021ee8eebca5d94c3da82be3a
SHA1 hash:
0d22c97588e3043d5197045255d1240bf9d3536d
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
SH256 hash:
bcc055cb4c2ed40dd497f51a187ef1a271f2ff003df2a934b01e84ce391d8057
MD5 hash:
b3abc9bcb5b5c1eea61e7afea4459326
SHA1 hash:
108036f7cecc83119a5cadb154321a92fdf70c9f
SH256 hash:
9cb9f3549cbb7ab95699b23036f604b74677075ceb6be7918a3d97c22ed914ff
MD5 hash:
69f7b44ad7a90e2cef90db674a9424e8
SHA1 hash:
0ad9a90c898646dfb3568c128996f9c5b18d10e0
SH256 hash:
cda0bdcbd5b63706753534bb3a5099e52751a6df80764cba7200f2aac6c0899a
MD5 hash:
e2fc4441122d134574147c332ca79e9f
SHA1 hash:
84177209c5d2f84f0290ecda851ba573c2d795f3
SH256 hash:
3ee6b2e12f816a3fd42dab31905ed04c3d219887f1e37f0fa2987b5402f00366
MD5 hash:
a1c4aebc2be356fed684292874cab02b
SHA1 hash:
5b5d03ee8e39694f9fb55818b6eedfcfda6c4b63
SH256 hash:
3d2b3fac65d44cca8f0e5c4620053d51e9bc6bd47ec5926de8f96ec13c491924
MD5 hash:
f56ebf4021ee8eebca5d94c3da82be3a
SHA1 hash:
0d22c97588e3043d5197045255d1240bf9d3536d
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
SH256 hash:
bcc055cb4c2ed40dd497f51a187ef1a271f2ff003df2a934b01e84ce391d8057
MD5 hash:
b3abc9bcb5b5c1eea61e7afea4459326
SHA1 hash:
108036f7cecc83119a5cadb154321a92fdf70c9f
SH256 hash:
9cb9f3549cbb7ab95699b23036f604b74677075ceb6be7918a3d97c22ed914ff
MD5 hash:
69f7b44ad7a90e2cef90db674a9424e8
SHA1 hash:
0ad9a90c898646dfb3568c128996f9c5b18d10e0
SH256 hash:
cda0bdcbd5b63706753534bb3a5099e52751a6df80764cba7200f2aac6c0899a
MD5 hash:
e2fc4441122d134574147c332ca79e9f
SHA1 hash:
84177209c5d2f84f0290ecda851ba573c2d795f3
SH256 hash:
3ee6b2e12f816a3fd42dab31905ed04c3d219887f1e37f0fa2987b5402f00366
MD5 hash:
a1c4aebc2be356fed684292874cab02b
SHA1 hash:
5b5d03ee8e39694f9fb55818b6eedfcfda6c4b63
SH256 hash:
3d2b3fac65d44cca8f0e5c4620053d51e9bc6bd47ec5926de8f96ec13c491924
MD5 hash:
f56ebf4021ee8eebca5d94c3da82be3a
SHA1 hash:
0d22c97588e3043d5197045255d1240bf9d3536d
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
SH256 hash:
bcc055cb4c2ed40dd497f51a187ef1a271f2ff003df2a934b01e84ce391d8057
MD5 hash:
b3abc9bcb5b5c1eea61e7afea4459326
SHA1 hash:
108036f7cecc83119a5cadb154321a92fdf70c9f
SH256 hash:
9cb9f3549cbb7ab95699b23036f604b74677075ceb6be7918a3d97c22ed914ff
MD5 hash:
69f7b44ad7a90e2cef90db674a9424e8
SHA1 hash:
0ad9a90c898646dfb3568c128996f9c5b18d10e0
SH256 hash:
cda0bdcbd5b63706753534bb3a5099e52751a6df80764cba7200f2aac6c0899a
MD5 hash:
e2fc4441122d134574147c332ca79e9f
SHA1 hash:
84177209c5d2f84f0290ecda851ba573c2d795f3
SH256 hash:
3ee6b2e12f816a3fd42dab31905ed04c3d219887f1e37f0fa2987b5402f00366
MD5 hash:
a1c4aebc2be356fed684292874cab02b
SHA1 hash:
5b5d03ee8e39694f9fb55818b6eedfcfda6c4b63
SH256 hash:
cda0bdcbd5b63706753534bb3a5099e52751a6df80764cba7200f2aac6c0899a
MD5 hash:
e2fc4441122d134574147c332ca79e9f
SHA1 hash:
84177209c5d2f84f0290ecda851ba573c2d795f3
SH256 hash:
3d2b3fac65d44cca8f0e5c4620053d51e9bc6bd47ec5926de8f96ec13c491924
MD5 hash:
f56ebf4021ee8eebca5d94c3da82be3a
SHA1 hash:
0d22c97588e3043d5197045255d1240bf9d3536d
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
SH256 hash:
3ee6b2e12f816a3fd42dab31905ed04c3d219887f1e37f0fa2987b5402f00366
MD5 hash:
a1c4aebc2be356fed684292874cab02b
SHA1 hash:
5b5d03ee8e39694f9fb55818b6eedfcfda6c4b63
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
SH256 hash:
3d2b3fac65d44cca8f0e5c4620053d51e9bc6bd47ec5926de8f96ec13c491924
MD5 hash:
f56ebf4021ee8eebca5d94c3da82be3a
SHA1 hash:
0d22c97588e3043d5197045255d1240bf9d3536d
SH256 hash:
bcc055cb4c2ed40dd497f51a187ef1a271f2ff003df2a934b01e84ce391d8057
MD5 hash:
b3abc9bcb5b5c1eea61e7afea4459326
SHA1 hash:
108036f7cecc83119a5cadb154321a92fdf70c9f
SH256 hash:
9d6c73e273a966a4ed1d93350392d965792ddf5ad201bfa28b8adcec2e344db5
MD5 hash:
adac60763fcfe4d5f4ad323046e79500
SHA1 hash:
9ced772a90ddec9fffde8c745225ad289f3f087e
SH256 hash:
2533d367f9ac30872666f71c6c786ddf9c1a60e24e07dfbc015d1640c5882743
MD5 hash:
8f43f2be0d3afe4c94a76594f04a9735
SHA1 hash:
6ab89fc9c930c99412593c7237baccc90f8c4c5b
SH256 hash:
9cb9f3549cbb7ab95699b23036f604b74677075ceb6be7918a3d97c22ed914ff
MD5 hash:
69f7b44ad7a90e2cef90db674a9424e8
SHA1 hash:
0ad9a90c898646dfb3568c128996f9c5b18d10e0
SH256 hash:
bcc055cb4c2ed40dd497f51a187ef1a271f2ff003df2a934b01e84ce391d8057
MD5 hash:
b3abc9bcb5b5c1eea61e7afea4459326
SHA1 hash:
108036f7cecc83119a5cadb154321a92fdf70c9f
SH256 hash:
9cb9f3549cbb7ab95699b23036f604b74677075ceb6be7918a3d97c22ed914ff
MD5 hash:
69f7b44ad7a90e2cef90db674a9424e8
SHA1 hash:
0ad9a90c898646dfb3568c128996f9c5b18d10e0
SH256 hash:
bc237ec67a9a6e358ecb5b4625e456ab55b6242359e0e04f379a82ba83004454
MD5 hash:
f31a6fdf5a1c4ef0ca3eefe3e6886688
SHA1 hash:
b7a6a91034484e177df6429325f875857f6f0323
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.