MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cd606b6517def70373af2bc7f92157ea0023a1178b4244a4cde44d122e52e52c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | cd606b6517def70373af2bc7f92157ea0023a1178b4244a4cde44d122e52e52c |
|---|---|
| SHA3-384 hash: | c54538e6dd5ae695f6eefe1dc33aac676260fab8871a604559a24c6779c4806c7178f14d1b2a07056922d1d522529995 |
| SHA1 hash: | 6fee53382d6c078ba08ade5a03bf3465715a31eb |
| MD5 hash: | adaae7414fc8b8a2c26eb1c4f4c55fa0 |
| humanhash: | north-golf-romeo-seventeen |
| File name: | cd606b6517def70373af2bc7f92157ea0023a1178b4244a4cde44d122e52e52c |
| Download: | download sample |
| File size: | 674'304 bytes |
| First seen: | 2021-02-28 07:08:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:FmdLV9hr+4QIVX78HGuNEAHJJ/WyPFxk0BzCk+9qnl/8n4pWkrKtT5zwryY:G9hr+dKX78muNEueWDk0RC9su4/rKtT8 |
| Threatray | 796 similar samples on MalwareBazaar |
| TLSH | FCE4231ADB526D13C2300EFE8DAB81802779EA149BF1DA76478CBB7261717F4CD6B024 |
| Reporter |  JAMESWT_WT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cd606b6517def70373af2bc7f92157ea0023a1178b4244a4cde44d122e52e52c
Verdict:
No threats detected
Analysis date:
2021-02-28 07:46:28 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Creating a process from a recently created file
Changing a file
Reading critical registry keys
Creating a file
Unauthorized injection to a recently created process
Stealing user critical data
Enabling autorun
Encrypting user's files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary contains a suspicious time stamp
Creates an undocumented autostart registry key
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-02-25 14:38:13 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 786 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
persistence ransomware
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
3686add615c5a3a3dfed005644f13a23b2f394167cc57daad526e8b8f29b922e
MD5 hash:
d51ad3f0c76fbdeda90cda1c562b8d31
SHA1 hash:
8dc7a67d01fde2f1b029c689887f003f7d1f0645
SH256 hash:
ed45341361592b4d72c24a9071b5f483deb574292f6f14d822f5afae05441b1a
MD5 hash:
e66ca907a49ce75adb6152a11dee1adf
SHA1 hash:
0bf658e904ffe526076a18d0bed669dcb793230c
SH256 hash:
736bed79f8779fd0fded1ef9bc7b7d377a207642bfef58485505d957bef94bab
MD5 hash:
52f76ffc89a347bd77ad31f151b684a7
SHA1 hash:
021647972707ec32551f2f79b1d09f84010aa675
SH256 hash:
cd606b6517def70373af2bc7f92157ea0023a1178b4244a4cde44d122e52e52c
MD5 hash:
adaae7414fc8b8a2c26eb1c4f4c55fa0
SHA1 hash:
6fee53382d6c078ba08ade5a03bf3465715a31eb
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.