MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e62e3e03c6d5ce19267e343b2f22d4815ca1e6e6f714b1f36b1f3a4a45813a00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e62e3e03c6d5ce19267e343b2f22d4815ca1e6e6f714b1f36b1f3a4a45813a00
SHA3-384 hash: 1b06797c28ceabef795c50075053db1e4514df17374d462a49ec11a448af521a860d298395d4ad3417e084fdf570b165
SHA1 hash: a789f618efac85ae8587cced81b7f1d66905b750
MD5 hash: 67a245d177b12e03bb1505325e5c7a31
humanhash: delaware-avocado-helium-wyoming
File name:file.exe
Download: download sample
File size:875'520 bytes
First seen:2023-04-06 09:03:18 UTC
Last seen:2023-04-06 09:44:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:8WepbHknL0scfDm7ofhjA8TLJfRhDZ7GKTBYj:25
Threatray 15 similar samples on MalwareBazaar
TLSH T1DA15D22129FF50AD73A79BA14FD8F8FF886AF573190E30F921911B468722E418D91736
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
245
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
No threats detected
Analysis date:
2023-04-06 09:04:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c8de4c45-e6f6-4377-9734-154e36e79f61

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/380590/
Detection(s):
SecuriteInfo.com.Heur.MSIL.Abuja.2.23846.4150.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bladabindi confuserex net packed packed
Link:
https://www.filescan.io/uploads/642e8b030a8c21410f57c174/reports/3e7a0809-510e-43fe-9cdf-7b73cff2b5d8/overview
Verdict:
Malicious
Labled as:
MSIL.Abuja.Generic
Link:
https://www.hybrid-analysis.com/sample/e62e3e03c6d5ce19267e343b2f22d4815ca1e6e6f714b1f36b1f3a4a45813a00
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/74a29625-084d-4d0d-b492-102734de428f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1209521
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e62e3e03c6d5ce19267e343b2f22d4815ca1e6e6f714b1f36b1f3a4a45813a00/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2023-04-06 08:46:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4yxd4a6g2xhbsjt6gq5s6iwuqfokdzxg64kld43ld45eurmbhiaa._file
Verdict:
malicious
Similar samples:
53d8f435075a3f419aff2ea631201f02d682a2ed92fc3bbb265faac63c5cbbdc
5880734f092220f1502fba1ec1ba45572e8b84715cba0dbf9cc947ba9e7d2670
75389e2a92cb68d21e3dba011fd89eeb74749a23efd15154fa24770ab2a85ca7
7877200f3f382801e8f65f786bd6d0fb44da6e8c55d52876cdb5a513ecd56829
82baf64498db84e1055074f6227fc502804f3f89a8aebc6d86ccf754077d0eea
8c8946de373b0f3a3566acffb6d99d860bc8aa19cdc2e401d3f2b7588529e490
c32079e2c46336bd8c6e0ee89733f08063563391b1fcdc46193a0cc9b445c808
fd687a05b13c4f87f139d043c4d9d936b73762d616204bfb090124fd163c316e
+ 5 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230406-k1lfcacd23/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
e62e3e03c6d5ce19267e343b2f22d4815ca1e6e6f714b1f36b1f3a4a45813a00
MD5 hash:
67a245d177b12e03bb1505325e5c7a31
SHA1 hash:
a789f618efac85ae8587cced81b7f1d66905b750
Link:
https://www.unpac.me/results/6b61a75c-bde0-4934-9c85-a040e30ccd42/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e62e3e03c6d5ce19267e343b2f22d4815ca1e6e6f714b1f36b1f3a4a45813a00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/380590/

Comments