MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c73727a59abf1e651fad4baf0710cd6b62e6ca1799d69a6b539a34229778d1ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c73727a59abf1e651fad4baf0710cd6b62e6ca1799d69a6b539a34229778d1ca
SHA3-384 hash: 7ef98f3d962df53bb828cfdb5158a1d2cf43e1b9e8ead1ef81e63c873fe18c14f3312e61b0ca829ac3fd80853a9a8d36
SHA1 hash: 1849de4f26a7e0140d713392786264e451b459c6
MD5 hash: 219bf08ade5d33c5d753cadd4b7608ac
humanhash: connecticut-uniform-uniform-comet
File name:219bf08ade5d33c5d753cadd4b7608ac.exe
Download: download sample
File size:6'656 bytes
First seen:2022-03-09 15:17:43 UTC
Last seen:2022-03-09 17:27:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'749 x AgentTesla, 19'653 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 96:9becbqIXlMrN2mIG3nCKeX34fpQtRjERidDNzNt:96uKRI4beXoynjEin
Threatray 19 similar samples on MalwareBazaar
TLSH T1F6D1942AA3D89637CDB64B3358A362500679F784DCA79B7F748410365E963280F62B31
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/248755/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.48455819.10168.17839.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6228c536b94fb38cb4488638/reports/48ad34a2-8971-4d87-9169-6b72a513f12a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Revirdit
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/60175542-fd32-4da9-8331-09050c456b87
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/953722
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c73727a59abf1e651fad4baf0710cd6b62e6ca1799d69a6b539a34229778d1ca/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-02-23 03:08:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
13 of 42 (30.95%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
32b793817b07a78490aa882218fb2880723c7ba23381545a2d7facfe0cacf4c1
38920e6f3a9c5908e9360388f0aa1f65b8e3df46849d758db7e1cdbf84727e3f
3f1f0dce8eb0b1a98912a8c08208c5d4425e013e20719aca1d14ca4924f841c6
46e839531c22208c8702a44dac0927a0ffb580c1efeabf71acd2df4aba0d5ada
574e414e22746d7781bd6ca6f4cc64be417b65696104dda71b037c9584cea01f
5bb7ab8d474109d82d8dfa3aae223df280517fe425a54d33d16ef5d00d49fcc1
8758c8727fc2f359daee8f056460f3353bd807cc591000570b97358b2c914c96
cdfc1600f7f5656fb2b72fd10da44b8f7e12f4c40027a4338251e5d7e9f0e743
d153e8b542963a9c9ae3fa96421f2ec2c5779759d0a086f3545b7e9c91074476
d733031bac48ebb66a6a12347c3fa50852da1023486f591679043ef07c9cad7c
+ 9 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220309-spl7hahgg2/
Unpacked files
SH256 hash:
c73727a59abf1e651fad4baf0710cd6b62e6ca1799d69a6b539a34229778d1ca
MD5 hash:
219bf08ade5d33c5d753cadd4b7608ac
SHA1 hash:
1849de4f26a7e0140d713392786264e451b459c6
Link:
https://www.unpac.me/results/ba63c61b-86bd-4a10-b7b1-bdae13b92631/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/c73727a59abf1e651fad4baf0710cd6b62e6ca1799d69a6b539a34229778d1ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe c73727a59abf1e651fad4baf0710cd6b62e6ca1799d69a6b539a34229778d1ca

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2078811/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/248755/

Comments