MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e39b5bbc4f6b82c02137614dce1bbb4f71098546db1fccb32d48b3f46937f7e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e39b5bbc4f6b82c02137614dce1bbb4f71098546db1fccb32d48b3f46937f7e1
SHA3-384 hash: 132420b142758eccc15f15448b42eb6cf81ef52978ad2fba77dbfc337d54bc522ad84bc43e5bee7b3c1b86fd01659a68
SHA1 hash: 90ed65c13a4701129d850c382619c3aaaeb1bee5
MD5 hash: c1cef67679b7a008487d4c3aa3b3b0d7
humanhash: wolfram-bulldog-ack-jig
File name:493b3197cd58f276f84e2e721146fbc3
Download: download sample
File size:508'264 bytes
First seen:2020-11-17 11:58:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 969027af29538e7bf04f3002e735dc1e
ssdeep 12288:AAiIRJqawzOxdP6A0GDyX91/OMbRxxedv86+w4qoXa0b9:AA5OCxdPdORxwvWwuf
TLSH 6EB49E00B890D032D27320B546BDD5A66DBD78316BB196CF63C819B89F245D0AB36F7B
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Autoit-9790147-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Running batch commands
Launching a process
Using the Windows Management Instrumentation requests
Launching the process to change network settings
Sending a UDP request
Connection attempt
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e39b5bbc4f6b82c02137614dce1bbb4f71098546db1fccb32d48b3f46937f7e1/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-11-17 12:01:24 UTC
AV detection:
9 of 27 (33.33%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  5/10
Tags:
persistence
Link:
https://tria.ge/reports/201117-s6nswww5ja/
Behaviour
Enumerates processes with tasklist
Gathers network information
Gathers system information
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Unpacked files
SH256 hash:
e39b5bbc4f6b82c02137614dce1bbb4f71098546db1fccb32d48b3f46937f7e1
MD5 hash:
c1cef67679b7a008487d4c3aa3b3b0d7
SHA1 hash:
90ed65c13a4701129d850c382619c3aaaeb1bee5
Link:
https://www.unpac.me/results/9ab93c3f-043e-4585-bcfe-216d4a84ee85/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments