MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df096497c8a776e02ecc469f0caa00738b022e6eaaacbc8896df2e7cf727eaad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df096497c8a776e02ecc469f0caa00738b022e6eaaacbc8896df2e7cf727eaad
SHA3-384 hash: 86cc56bbac11bfe26ad3b23e032d907dad1b1508252c477c5c57dbd54e3d5f8299978d805ad4be8c12b162a16336f843
SHA1 hash: 8486ef49e3d558402471956c448acf79f3321435
MD5 hash: d32f3dbf9c9646fa0af341efc9a52542
humanhash: tennis-video-xray-mirror
File name:df096497c8a776e02ecc469f0caa00738b022e6eaaacbc8896df2e7cf727eaad
Download: download sample
File size:207'721 bytes
First seen:2020-11-07 19:30:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 87bed5a7cba00c7e1f4015f1bdae2183 (3'034 x Jadtre, 23 x IcedID, 17 x Blackmoon)
ssdeep 3072:EhOm2sI93UufdC67ciRt3ujFf7TQsq5VaQl:Ecm7ImGddXRt38TU5Zl
Threatray 2 similar samples on MalwareBazaar
TLSH D514F1F1192CB1F7D4B8F471A552A568104363F7AD821CDA22A806CD1E78A92DA83D7F
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Agent-1388682
Create hunting rule

Win.Malware.Babar-6876576-0
Create hunting rule

Win.Malware.Babar-6877468-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df096497c8a776e02ecc469f0caa00738b022e6eaaacbc8896df2e7cf727eaad/
Threat name:
Win32.Trojan.Dinwod
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 19:39:53 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
ac493dfe6ba54362debbed51325303a9d6811c31d1ef399c76fe45604f50bc82
e702b64f3835bf5086d5242482fa422d0821c4502a075be429572bf79972b01d
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201108-89d4ysbckx/
Behaviour
Suspicious use of WriteProcessMemory
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments