MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9728eb0f0e75969ff53f0b28044669f546dfcedb72f43595c54667f34d493b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9728eb0f0e75969ff53f0b28044669f546dfcedb72f43595c54667f34d493b6
SHA3-384 hash: 82f2983cdad868e3af2ec736536d68421140a8cb0d460ec5d315a7e672664dc3ab85c99bafd6094dc23cd1516afb880d
SHA1 hash: ca5dc14f2d3cc4b8b857731d34ff614ddb055952
MD5 hash: 075cf32046309600c4e47dc0576c5f9b
humanhash: mango-stairway-oxygen-steak
File name:Packling_List_00565456.exe
Download: download sample
File size:1'703'936 bytes
First seen:2020-05-19 13:59:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 49152:rw80cTsjkWa6pLOrGQaioQHVqWZKhmw6:E8sjkaOrGQ91qSK
Threatray 812 similar samples on MalwareBazaar
TLSH 9B75D02273FD8363CB769173BF69B3057EBB38650630B8572E880D79A950171162C6AF
Reporter James_inthe_box
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 05:13:31 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5fzi5mhq45mwt72t6cziardgt5kg37hnw4xugwk4krth6nguso3a._file
Verdict:
unknown
Similar samples:
06fb34932579887447d77ec1474c7fcd43c571613fc1e704b45c8ffbc6f4212b
26cb425375a7613736c367866d0b79b8b7d8845437ec88e87bc83146445f892e
36f3bdf1bd05519baf7a6a3880b2d0043057aea8fef15f2a4e55b8a474916cf4
39084137359a20b1df1063f78af9d673aefb3aaedab4d070be247c9eb5ca9e71
40ac8e128b78d30d49accda865a6ca90a23cf7b7e5f31042c7df55a9fe1b5af4
6083d7084795ed9d60be324c610dbfab644a3e25c982755a93071e23db11198a
793f375be5ed01b66b47d24ca49594af11ddcd125f3fb41ca77cae45632eba52
96e78a7404f0a5713d809b9b4609cf12872c9efeb22c4ea95219737d93665bf9
b29a1b48648aacf2fe60861692bd0991cf226956ea986b687972667496e1d7d7
fd25b09006d514098cff84fe7c68b57ddbf3f5b6229e419689e2bfb28164b6e7
+ 802 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-gb2sx6vk12/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Drops startup file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments