MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d6d9a32fd696e4980d644f655563379ba7b04a2e3db03bbe6fbfb894fa68b152. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | d6d9a32fd696e4980d644f655563379ba7b04a2e3db03bbe6fbfb894fa68b152 |
|---|---|
| SHA3-384 hash: | 7bac71c12d9d5ee57ba9dc1e92236f6420ac3856a2d96b4a6b0fcddff672533c3bd69ab3de1d530ca82b7dea846731fa |
| SHA1 hash: | 88bcd8e12bc6c7d9fee6948ae1923b4d8a9c0e62 |
| MD5 hash: | ce56f130c12f75c8b26151d1c3a6de37 |
| humanhash: | salami-tango-lithium-mississippi |
| File name: | ce56f130c12f75c8b26151d1c3a6de37.exe |
| Download: | download sample |
| File size: | 294'400 bytes |
| First seen: | 2020-10-14 14:49:10 UTC |
| Last seen: | 2020-10-25 20:55:39 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 6144:NdJ8TzKStzgzwp/15hvdNeOu7x36zcuDYlclza/nEO+Z95G2NiwwGU3lbo8CM:98TWEEkV1TSKzlicBa/EO45G2NiwrxU |
| Threatray | 495 similar samples on MalwareBazaar |
| TLSH | 60544BD93B51798FDA2E8C72C9141E30A621B666630FF3973463B1EB6E4E7568E010F1 |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a file in the Windows subdirectories
Creating a file
Creating a window
Launching a process
Changing a file
Setting a global event handler
Running batch commands
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Searching for the window
Forced system process termination
Creating a process with a hidden window
Possible injection to a system process
Unauthorized injection to a recently created process
Launching a tool to kill processes
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
96 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (overwrites its own PE header)
Disables Windows Defender (via service or powershell)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Spyware.Stelega
Status:
Malicious
First seen:
2020-10-14 14:51:05 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
2/5
Verdict:
suspicious
Similar samples:
+ 485 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
evasion trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Kills process with taskkill
Suspicious use of SetThreadContext
Executes dropped EXE
Contains code to disable Windows Defender
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
3a9c958806872045c65936980c8b9b6a1390bec4065fa2b19f312f021e4d964b
MD5 hash:
a120b396e4b3b03ca74d55230e7cdd18
SHA1 hash:
152682a454ced499b33a4be0db28a63c22ba5d0f
SH256 hash:
087d0c0315da38a9c29aab66a628d05b169013d8135de9652e6a83bee15e8d8d
MD5 hash:
215d10c58de49c8d224e9a77d42961db
SHA1 hash:
2bb0effd16fb00c44aa78ba949a0e0d9a1cb4f94
SH256 hash:
f7d9066a5a7e131be46e8857403e93e9bc24a64531cd9c6f9372f7a149100865
MD5 hash:
ab4e71e387fed9ff8e5fe60ffab1d8f3
SHA1 hash:
5652006d42740ee8b59caa75ac37afffb156ba5c
SH256 hash:
d6d9a32fd696e4980d644f655563379ba7b04a2e3db03bbe6fbfb894fa68b152
MD5 hash:
ce56f130c12f75c8b26151d1c3a6de37
SHA1 hash:
88bcd8e12bc6c7d9fee6948ae1923b4d8a9c0e62
SH256 hash:
1774d1c6ef7bdaaf0413c16649a32f7f5f8915d7baf950178019829e5de62a44
MD5 hash:
77be59d7edee7fbd9180478ef792994f
SHA1 hash:
919fbe3e74fb3da5f8487b841a3a0f466b0c4d75
SH256 hash:
88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03
MD5 hash:
f4b5c1ebf4966256f52c4c4ceae87fb1
SHA1 hash:
ca70ec96d1a65cb2a4cbf4db46042275dc75813b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe d6d9a32fd696e4980d644f655563379ba7b04a2e3db03bbe6fbfb894fa68b152
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.