MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f291b68a9b9889a01d736cb0079c8be1e3f576d19ba1f4762cf2302984455bd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f291b68a9b9889a01d736cb0079c8be1e3f576d19ba1f4762cf2302984455bd2
SHA3-384 hash:	c629b3e3bee86579d83cf89bfc3e74aaa311cd64a3dedf7201f29bdb2fc89112189df612d8fb7d5a03d7c25211e3b962
SHA1 hash:	9e88306ed91920dbd269f34031ec3eb6913c77e7
MD5 hash:	5de4c3c0ce0e241c76fbb11b625c08fb
humanhash:	lake-fifteen-arkansas-mobile
File name:	eqd.exe
Download:	download sample
File size:	21'643'797 bytes
First seen:	2023-08-28 19:05:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ca4e65ef48cd8fb5249e69100e9eba9e
ssdeep	393216:yNqMfrP3DdxTKbVqJHI/GggKXIP9OzLbmPpmt4HCmCi+3ms5KrXBF:2Dvdxm5GI/vdw9OzLbmPHH+36rR
TLSH	T15B2733AA2D637430DDCED2F56FB088CDAE6097DB8119FE8B591340F95D8B14A6027C72
TrID	45.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.3% (.EXE) OS/2 Executable (generic) (2029/13) 18.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter	smica83
Tags:	exe HUN

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

331

Origin country :

HU

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

eqd.exe

Verdict:

Suspicious activity

Analysis date:

2023-08-28 19:08:35 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4f1216ec-1775-4c0a-8e15-457b408e7968

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

khalesi lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/64ecf01bb3b7d7c782d0b2ff/reports/c44f6a76-a925-42c9-bd6a-124a016c1ffe/overview

Hybrid Analysis Trojan.Win64.Agentb

Verdict:

Malicious

Labled as:

Trojan.Win64.Agentb

Link:

https://www.hybrid-analysis.com/sample/f291b68a9b9889a01d736cb0079c8be1e3f576d19ba1f4762cf2302984455bd2

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1298996

Signature

Hides threads from debuggers

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ki3ncu3tce2ahltnsyaphel4hr7k5wrtoq7i5rm6iyctbcflpja._file

Threatray unknown

Verdict:

unknown

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://tria.ge/reports/230828-xr3dqahh7x/

Behaviour

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/f291b68a9b9889a01d736cb0079c8be1e3f576d19ba1f4762cf2302984455bd2