MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 edb7c1252fc4d53a733afe5b74dfab6395bcd90ea2c3cf0664e3b610e84e24d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Adhubllka
Vendor detections: 13
| SHA256 hash: | edb7c1252fc4d53a733afe5b74dfab6395bcd90ea2c3cf0664e3b610e84e24d6 |
|---|---|
| SHA3-384 hash: | 4a89761530ffc1714ff508c8e53933abd824d7b50fc6187dba9ec43200a3f18edb9b4a0fd2b2c30f9f171398ea8c82eb |
| SHA1 hash: | fc8930cd264393552727a457efbbea67e60e49e5 |
| MD5 hash: | 13d8c2f2cdf5f6208c3e999621019304 |
| humanhash: | robert-mobile-green-lake |
| File name: | 13d8c2f2cdf5f6208c3e999621019304.exe |
| Download: | download sample |
| Signature | Adhubllka |
| File size: | 905'728 bytes |
| First seen: | 2022-12-01 13:50:28 UTC |
| Last seen: | 2022-12-01 17:31:27 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:qJm9QjL9Qa8P6artQ2EIcs8A5jX7BIBi8pV4VpQWsNTAvc1NfpHsVfdc:qQ6jJQa8PTt5EIcs8WpB8pnzTUcO |
| Threatray | 5'101 similar samples on MalwareBazaar |
| TLSH | T19415ADEA13955D93D9097DBF5ECCB84E22AE09B3CFFE95C81E14B84106B66598E00FC1 |
| TrID | 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.8% (.SCR) Windows screen saver (13097/50/3) 8.7% (.EXE) Win64 Executable (generic) (10523/12/4) 5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Reporter |  abuse_ch |
| Tags: | Adhubllka exe Ransomware |
Intelligence
File Origin
# of uploads :
2
# of downloads :
534
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
13d8c2f2cdf5f6208c3e999621019304.exe
Verdict:
Malicious activity
Analysis date:
2022-12-01 13:51:09 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
DNS request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Searching for synchronization primitives
Changing a file
Moving a recently created file
Сreating synchronization primitives
Modifying an executable file
Moving a file to the Program Files directory
Moving a file to the Program Files subdirectory
Launching a process
Encrypting user's files
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BitRansomware
Verdict:
Malicious
Result
Threat name:
Cryptolocker, ObzCrypt
Detection:
malicious
Classification:
rans.spre.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Drops executable to a common third party application directory
Found ransom note / readme
Found Tor onion address
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Yara detected AntiVM3
Yara detected Cryptolocker ransomware
Yara detected ObzCrypt Ransomware
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Status:
Malicious
First seen:
2022-12-01 13:11:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
16 of 26 (61.54%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 5'091 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
persistence ransomware
Behaviour
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Enumerates connected drives
Loads dropped DLL
Modifies Installed Components in the registry
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
a327516357b9fa1a75753b3fbd0030e13f374be7cefcdf983d0b731f278b0c59
MD5 hash:
404efdeb9931733904da07f96fabeb72
SHA1 hash:
7ce363cd612f1d9a90b33ec196c4d0a49cdaee02
SH256 hash:
12038912f9038bfdfe3a0c8fed6a5d0ca3519ec9f1ab57e0ccf239e32944cd34
MD5 hash:
a54f230f14b9196720b31c37a85ce2f0
SHA1 hash:
63c03ff569356fe9bd066890608d5e15e275fe36
SH256 hash:
269a4d7b29b8e1883c505676dc03357f317f9214af0854f518d4778cfad1f7f5
MD5 hash:
6794e632ac61a87e6c53c7cf4086798a
SHA1 hash:
142dc4f2ea0dd132d9614f86b9bcda03c7d5cc77
Detections:
win_adhubllka_auto
win_adhubllka_a0
SH256 hash:
5826a994056ef7c781c0965bf0ac9802d5ba6c5f28478b2187c208992aca5b3e
MD5 hash:
e1e4638e747a5a0b2a3bbac230c05689
SHA1 hash:
8854df05277927d2d1f815fc4d5c8baeed4bd743
SH256 hash:
dddd6c322082b3fd7bab65d06cc977652f2fe25c01acaaf69fc1ef219a45caa1
MD5 hash:
68d556831db9ae562a50b2adba551994
SHA1 hash:
fabfbab5645a62d91b8ad967f216c2e28edfed69
SH256 hash:
7114e643f891fc4a6d81138d9f1a773366d632ad7e41a36f50ba4a82d14df9ad
MD5 hash:
1463ca65807b52912581a0cba24dbe8f
SHA1 hash:
f177421e6bcab34a75846aeb4c4763c18c527beb
SH256 hash:
5fd51b234cdf078ea24d5d65ffadd2e75932e81bc227fc023e70c25f4e85bd64
MD5 hash:
399f19d153346a0f91cbf31cbff6104f
SHA1 hash:
e975c87859350deb5f8db3bf1d7a1fc163255e93
SH256 hash:
82d63303fd49f3a9d52e95393fc5bb581bbe9d650d67ee7ccf3f4a0b5554630a
MD5 hash:
6de80def7e5cd1405b1f45b0432946f4
SHA1 hash:
e21dd25de14a142e85cb6fd593b7fdd0b107a24b
SH256 hash:
8bb26764d7891d0f048cad5d84c999756d7041a128574b8225e7b62e195bdac6
MD5 hash:
dd2b341d6b85f7dacfb449bd05583d6a
SHA1 hash:
55b579fb8903b106c6582d861175fe53bfde3890
SH256 hash:
e37aa72bca3cecb9bdbe51cbd81ec1143bb17163088a1379a4ccb93f5d881e76
MD5 hash:
5cac4fe734fc8454ccb847e030beee38
SHA1 hash:
34298fe220e35f614b2c837cf1dc2604ab0882d6
SH256 hash:
edb7c1252fc4d53a733afe5b74dfab6395bcd90ea2c3cf0664e3b610e84e24d6
MD5 hash:
13d8c2f2cdf5f6208c3e999621019304
SHA1 hash:
fc8930cd264393552727a457efbbea67e60e49e5
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.