MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd3fa67db19a3c6dca531dacecb9e2ddebc7d29237860d9cbdc637f47059eb5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd3fa67db19a3c6dca531dacecb9e2ddebc7d29237860d9cbdc637f47059eb5e
SHA3-384 hash: d3ea50d01323ea6fbe455258aa18dd8e8e83c864836ff71e618df63bf12978dda5441420f7e3cfdfcb22910c142445b0
SHA1 hash: 1bc3fe6e6c878cec2e6b158897c1f3f278db511b
MD5 hash: a702da125da1d519ce4625e006ae3c2c
humanhash: cat-fanta-four-ceiling
File name:SecuriteInfo.com.W32.AIDetectNet.01.6960.20286
Download: download sample
File size:40'960 bytes
First seen:2022-05-08 16:33:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 384:Y+dAU4ymjmQwx1hPUEX1gQXulaiAMwCKFH2S3dd0hUADkaTM:lAU4ZQP/WxlmMwCK/3deVDq
Threatray 11 similar samples on MalwareBazaar
TLSH T12D03E71A7892961DC9D47BF869B1619766367CE10124C18FECF9BF29A933223CCC216D
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 174f4559191b1b13 (81 x AgentTesla, 68 x Formbook, 34 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetectNet.01.6960.20286
Verdict:
Suspicious activity
Analysis date:
2022-05-08 16:34:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fa029b42-23a2-46e4-98ea-46e73acc4e19

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.6960.20286.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6277f10c4b517e213c247f83/reports/7681b68c-91a0-4fab-805b-b86a6e54d8d3/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cc74953d-94a3-4a42-8336-55777ad70c01
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/989782
Signature
.NET source code contains potential unpacker
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd3fa67db19a3c6dca531dacecb9e2ddebc7d29237860d9cbdc637f47059eb5e/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2022-05-08 13:25:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
17 of 41 (41.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xu72m7nrti6g3sstdwwozopc3xv4puusg6da3hf5yy37i4cz5npa._file
Verdict:
unknown
Similar samples:
23bd17fba8c0cb660dada2c952431dc7e335bbdfb8e34078da941a29652526d5
3d37c3617a157667f9e536996ce1f4e790060b8b8449f905bf9c1f5bcd09b7a9
47934dfea8c7ec9a59ac5b99f4e440a668f8217999b7f03020bbee22720404ce
670d2b752c68da68cdfd9d1b2f5a2f994509e563cc7ca3f1049d5503b8f48369
79541840f37314c88b923c55cfa29bc952a514242edce7b9a54a937a6f5ed985
e1422dbc6631aec397fe0dc7298ec6b52570720f2fb6c7605db0a72b48809df9
e69d8cb762149ef5d9cbc14ba3b4c1a48395c5261f9c404608a37c1807f1e19e
eedd8e36fccdd66ba60d50f2c187b6600550332a3d377338f3641eb8cff7f1e3
f1c367a9e61a79e35b25ced3249166e442845a3d63a06524fb908477140c9f10
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220508-t2368afdcm/
Behaviour
Suspicious use of AdjustPrivilegeToken
Program crash
Unpacked files
SH256 hash:
bd3fa67db19a3c6dca531dacecb9e2ddebc7d29237860d9cbdc637f47059eb5e
MD5 hash:
a702da125da1d519ce4625e006ae3c2c
SHA1 hash:
1bc3fe6e6c878cec2e6b158897c1f3f278db511b
Link:
https://www.unpac.me/results/b9a94f8c-9bbc-45c7-b90d-298b12cd2104/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/bd3fa67db19a3c6dca531dacecb9e2ddebc7d29237860d9cbdc637f47059eb5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments