MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6120e15798b03619a4cd1f71ef573c8203989eface8e1f4533780f0f8fc50a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6120e15798b03619a4cd1f71ef573c8203989eface8e1f4533780f0f8fc50a2
SHA3-384 hash: a21d75e498a66fd55b09ff4562d3bb67b503620d74d97f2fd1e6966a0e11e0082ee4faaf453997d9799d1dd1b51bca45
SHA1 hash: e8f31130925b066c6b3b9476e7326218a23f6fe0
MD5 hash: cf6a38328d0bde9b661192aa889a7f6a
humanhash: freddie-nuts-cup-twelve
File name:d6120e15798b03619a4cd1f71ef573c8203989eface8e1f4533780f0f8fc50a2
Download: download sample
File size:1'309'184 bytes
First seen:2020-06-03 09:24:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c1d258acab237961164a925272293413 (5 x AgentTesla, 1 x njrat, 1 x SnakeKeylogger)
ssdeep 24576:atb20pkaCqT5TBWgNjVYvrrQsRdHYY9o87wWfy:HVg5tjVYvrUsbHTo877f
Threatray 943 similar samples on MalwareBazaar
TLSH C355D02373ED8360C7B25173BA55B712BEBB782506B5F86B2FD8093CE920161521E673
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PrivateExeProte-16
Create hunting rule

PUA.Win.Packer.Ep-7
Create hunting rule

PUA.Win.Packer.Embedpe-3
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Win.Malware.Autoit-6887901-0
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.Passup
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 17:32:02 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
0b754578fd025440dc9661b2a4f0c853fa57a9dbb2c33d27ff7802176d38238b
1edf8c6bcf0ae2b38e9e28bcb1fd838c2ea35b5b126e4bc9e42daa2e1e722298
3d611ca54f64546327d9bc6993662d5058a7f07fa8e16b81fc7ee6ff60d952f2
4f51da0a7034a3b491bf21d56896d2cc97f5f240911abfaeacfe73d80bd84a34
a9da529f0ad9088cec7e9441a7081084f417655533998caa004597a1bc6ef262
af076d38fb1a0fe805a6a835aefa72a1eaa827bb0421dcc91bd2e6153469d60d
d461810943d78b803fbc9a0ea85d16325af10764243d7d3d6b7b24d52efe685c
dfeb957fc25e4102bf74a28e214d8ad5488d85b552824e0cd1f3c856f3a62acc
f32d1725c917672afcea8f55889bd90ad5199f7d40b7656dba7e365f7df4b79c
fe52c98bfa1f03fa429f4044d5e5bfc3cfd4a571a0f6d37e955397cf583cace5
+ 933 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-pg5r3dasqa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments