MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c0aa14e8c2382358c88ae0c35faa89b4969797b3f3672479111e57a60a85963b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | c0aa14e8c2382358c88ae0c35faa89b4969797b3f3672479111e57a60a85963b |
|---|---|
| SHA3-384 hash: | ff693cdbf0f259afd9d7eb6cf30dd6ca839488fbfde417718e291fee19c63c64e3a44e63dc4d8ebf570f94a231e79b7e |
| SHA1 hash: | 6e28f92185ac507ae0f2168ed73127b443ef6ed2 |
| MD5 hash: | 71a0a671a1f87747ef9adaedde315ddd |
| humanhash: | blossom-oven-vermont-tennis |
| File name: | 71a0a671a1f87747ef9adaedde315ddd.exe |
| Download: | download sample |
| File size: | 5'842'673 bytes |
| First seen: | 2022-03-22 19:01:24 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 69 x LummaStealer, 61 x Rhadamanthys) |
| ssdeep | 98304:rWqZmdlx7iCrZ/+9SKyICxTqEdSPXXTyQozuv6HZBs7eAlWVE5:rszWCrZ/1LjT4vlo6vqDs7eAlWC5 |
| TLSH | T1AE46331A92E4D4F5D47997BC4AE05323D72A7C921F74A2FF1768D2722D31A90BC34B0A |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
advpack.dll clipbanker control.exe mikey overlay packed rundll32.exe setupapi.dll shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Status:
Malicious
First seen:
2022-03-22 19:02:20 UTC
File Type:
PE+ (Exe)
Extracted files:
26
AV detection:
17 of 42 (40.48%)
Threat level:
5/5
Unpacked files
SH256 hash:
c0aa14e8c2382358c88ae0c35faa89b4969797b3f3672479111e57a60a85963b
MD5 hash:
71a0a671a1f87747ef9adaedde315ddd
SHA1 hash:
6e28f92185ac507ae0f2168ed73127b443ef6ed2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe c0aa14e8c2382358c88ae0c35faa89b4969797b3f3672479111e57a60a85963b
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.