MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e431da31eb509224ab13458b7f50a92f3a2f41cf01c8014f69f0eaf9339ab9e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e431da31eb509224ab13458b7f50a92f3a2f41cf01c8014f69f0eaf9339ab9e4
SHA3-384 hash: d6f15630afba4ab91f63ef8c509206cf4ea5f707852d3d8cc17b321ee9fecd253268d6fa5c1d736a5c1e7b00b9b1a330
SHA1 hash: 3e721625a33b3d4baef420c1c7397e338a57b23f
MD5 hash: 57a3c027ae6556b13744bc6096e1825a
humanhash: diet-three-burger-low
File name:0WCLsG8DXRR4L6nx44K2.exe
Download: download sample
File size:1'266'692 bytes
First seen:2021-05-05 11:27:14 UTC
Last seen:2021-05-05 13:21:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:He32534uUPTwUkem046A9u0Fh0y0WA2u+JCBGuDiDkqYtqT2M1T2+6LcM3QskfvV:HVUVkNi9APtrZRF59asCPqJ59LGKj
Threatray 28 similar samples on MalwareBazaar
TLSH C345E6D439E22D8D6560738308FEA0FE2DAEB8B5FA35062D65519B57C3E01128F817F6
Reporter starsSk87264403

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150522/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.29.614.11294.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Launching a process
Unauthorized injection to a recently created process
Adding an access-denied ACE
Creating a file
Sending a UDP request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Using the Windows Management Instrumentation requests
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e431da31eb509224ab13458b7f50a92f3a2f41cf01c8014f69f0eaf9339ab9e4/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-02 17:39:02 UTC
AV detection:
31 of 47 (65.96%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
04c9ccc533b33d9eaa98a4f82f32bcd142c1228492d195ab5335c094643b7a7c
33378b4ff2e8e5d64380bf24d787e4cae639cd41ceafbeeff82d7cf7a74be69a
8dc22e1920473eca003886953bc32cb4fe5c1ba16c8a6c6bced7fda43a421426
9eeaa4a0bcfc641d7f395c5a7d5ac15a8d50b18f8ef1ac3545c55c5679367228
a4f9a06d39f0b20bb9e04aab75db64d3cf18ee2025a890471536415b6f18fcd3
aeb4339ff4e4d6f8249236e1280111324d84920c23a169cffc67577ab9f69217
ce8284965a584e028e1c301a747acf3dfb472df4b06263b42634d00f7b40f77e
e111f6f2fa1deba59df581d3c6ef269c3e3628b2649cb728e30092d8d30e258c
f3c279e61de77236f3390c91dee09f02aa01974e14e429426fa174e0ff8a7512
f5a3c92032bc45af8e374b619a5b6d046e6c3eadc83dc84595bffc4d6acab717
+ 18 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/210505-sbjgzerjge/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
37192cd8db01a7b612691942928222c56da3b3aa0ef87c0d56d4cd7e008060df
MD5 hash:
278aced2f1a169a4d1fcaa002ff6b7fa
SHA1 hash:
c688a94e479862dda3841b4a43874b7674806e54
Link:
https://www.unpac.me/results/96a0e250-7eab-4dc4-8224-a4a68ae6532b/
SH256 hash:
9c38a7914f6bf2d6d5d79cfbf9774cb8635b23374e8f7b4b74d2437d83acb32a
MD5 hash:
eb1855d1e1c033ee597aea9aca119b4b
SHA1 hash:
c88a103eb0ae2d28acf941a10a517f0869fd3d03
Link:
https://www.unpac.me/results/96a0e250-7eab-4dc4-8224-a4a68ae6532b/
SH256 hash:
7fc4e8468946f758ed4ff0a14e70ac9e2e946f3e4a9cbd99b42135858c069f76
MD5 hash:
19f7e3bdca684e3dac51eae273ae728e
SHA1 hash:
7e2e6f9e0449447d619070111748b89789cb6273
Link:
https://www.unpac.me/results/96a0e250-7eab-4dc4-8224-a4a68ae6532b/
SH256 hash:
e431da31eb509224ab13458b7f50a92f3a2f41cf01c8014f69f0eaf9339ab9e4
MD5 hash:
57a3c027ae6556b13744bc6096e1825a
SHA1 hash:
3e721625a33b3d4baef420c1c7397e338a57b23f
Link:
https://www.unpac.me/results/96a0e250-7eab-4dc4-8224-a4a68ae6532b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e431da31eb509224ab13458b7f50a92f3a2f41cf01c8014f69f0eaf9339ab9e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150522/

Comments