MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9fb97f4905c60c4ae91c7765862cee4d323885e7e92fcafbbdc3aebb07fe926. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9fb97f4905c60c4ae91c7765862cee4d323885e7e92fcafbbdc3aebb07fe926
SHA3-384 hash: 643fdf432eba808ce4e89c853381dc29a21227ca9f6b4155119686eb4dabbc55b614e27f89bf456d56eb88dc71816702
SHA1 hash: 16ce9c1232196a5870deb49eb3ccbcfd6a059aa2
MD5 hash: 429bb0d910be938bf56d7926d12f4846
humanhash: bluebird-north-network-queen
File name:a534f16324616354c7f5f9d7ae94fee3
Download: download sample
File size:212'992 bytes
First seen:2020-11-17 15:30:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 03ae0108c7455c49c94d2d60afa1e57a (1 x Worm.Ramnit)
ssdeep 6144:xCEl19XTf76M/cpxhbFErwITAYCVJkEj1:hl1hu/5iwrzkC
Threatray 187 similar samples on MalwareBazaar
TLSH FE248D123950D102DC671A345CF5F2646A7EBC32BF74923F72843B4DACB0A595DB0B6A
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Razy-9759519-0
Create hunting rule

Win.Malware.Zusy-9759529-0
Create hunting rule

Win.Trojan.Agent-1381405
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Creating a window
Creating a file in the Windows subdirectories
Running batch commands
Creating a process with a hidden window
Creating a file in the Windows directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9fb97f4905c60c4ae91c7765862cee4d323885e7e92fcafbbdc3aebb07fe926/
Threat name:
Win32.Trojan.Aenjaris
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 15:37:05 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
03a54d3b7cf0d1f321fcb5453df8a03ce9578f6c807611ba00ce0fa27711e2c6
0b942c73fa2018c9a8ae7679306606f38eaaa9e6f8e223ebc87c78ec71678a54
1473388d4a4056bbc7ef3a0c2f9dbfedcef34d224efb75a285a70b21e0fa5c81
494e6ffe7fd77e2810a4edc7bef8717c32397466ef5fbf2639e8a16a76a4331a
55660dccdc37f6d750552c1ea134aa190a13a5be74b4d887038de2616b930e06
647482bed54f3618fb5466d726d77118d6965f519a4c518ddad1ec850db7a089
743826d85a6d09cc72c7502f8b887fc1bcdc77428f057aadee0dd1afd5b8f392
8898ce01761e5d52855090f46470430143457d2ac26993dc1ccf60f68e5443ef
f2cbd6cf4e246f79bd780b2f14ef2bd23ef9e02efa88d222407eda984ba4e485
f779c894c6888ba9ce5d0011c1af73dc0f55b087244b3608fd0de3152bf1929a
+ 177 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
persistence
Link:
https://tria.ge/reports/201117-1r4gxg7dza/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
ServiceHost packer
Unpacked files
SH256 hash:
e9fb97f4905c60c4ae91c7765862cee4d323885e7e92fcafbbdc3aebb07fe926
MD5 hash:
429bb0d910be938bf56d7926d12f4846
SHA1 hash:
16ce9c1232196a5870deb49eb3ccbcfd6a059aa2
Link:
https://www.unpac.me/results/9ee4d188-b8c8-446d-adc8-345263877a2c/
SH256 hash:
f1dacd8a08ed846b1b2d43535e2a5d65a62ebd19f0cef4de0d9b3934b73020c6
MD5 hash:
3916d5f7fd6d668438a54f288dc3aff4
SHA1 hash:
019c76190028f6574f8833c969dea69f0c6748b8
Link:
https://www.unpac.me/results/9ee4d188-b8c8-446d-adc8-345263877a2c/
SH256 hash:
3a83a95c6b6085043188ceae47dedf6984be0d910830c59022db1f732d5a8759
MD5 hash:
9c0d6dda779308c949debf9da3e8044e
SHA1 hash:
0e137553651b63eeb13b395d4c68b650681b738b
Link:
https://www.unpac.me/results/9ee4d188-b8c8-446d-adc8-345263877a2c/
SH256 hash:
7c767572e2df54970985c35f00a3e2d101a19b7aac4d718ce9c8c59d702f84a7
MD5 hash:
eea06349d0744a3dfff719093a343aa8
SHA1 hash:
c96c568ccfc6cdbc7e733c39d891248662be65c0
Link:
https://www.unpac.me/results/9ee4d188-b8c8-446d-adc8-345263877a2c/
SH256 hash:
50e68756be078054ae01a9bf90411f29baa4075eff589d68f8eb7df691560ab5
MD5 hash:
4aa322a33c5819b9c25db40d98b7602a
SHA1 hash:
927a02dd40cccb92ab42422e9db719125a41e45a
Link:
https://www.unpac.me/results/9ee4d188-b8c8-446d-adc8-345263877a2c/
SH256 hash:
17700d905a6a7bfbb4b17db488c540752bbb182b80e87fda3918d4c979f4146e
MD5 hash:
602e953f5742e2937f625661fd909929
SHA1 hash:
0871340a1007c96c12f989c019c02e284e53465b
Link:
https://www.unpac.me/results/9ee4d188-b8c8-446d-adc8-345263877a2c/
SH256 hash:
d6b6833f08d247f9d291012e9e00029ea80de115694dfc304ad6c867e0f73eee
MD5 hash:
6ac395193dcbd8b61ba2b19ffc9b281d
SHA1 hash:
187f30134d865fb29a0c996d10899073fdcb570f
Link:
https://www.unpac.me/results/9ee4d188-b8c8-446d-adc8-345263877a2c/
SH256 hash:
717f6e394cccd9110ef3540cc10b4031702af18eca8358ba5165551578fec3f4
MD5 hash:
a332c5ad6632c45ff81841173f5aaf8d
SHA1 hash:
8111a27b7d91bc2b15b5c1920a663cf4e07f9202
Link:
https://www.unpac.me/results/9ee4d188-b8c8-446d-adc8-345263877a2c/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments