MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f301558cfe40a9902af0ae4b404259541cc1a810e14d42cf2210317b800213b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f301558cfe40a9902af0ae4b404259541cc1a810e14d42cf2210317b800213b5
SHA3-384 hash: dff213b5cbddd38525d8e5ccebb8de212d3ea0fb2b5f27d6f68f708dca8b137b5f220fd804f88f97ff2dfabb600201d7
SHA1 hash: 5f0b6aebaa13b73c5cd36a20f066c39df1dd4543
MD5 hash: c2fd7aca9c671ccdfca82f7d0c2d2d0c
humanhash: paris-december-fillet-helium
File name:Purchase List.exe
Download: download sample
File size:457'216 bytes
First seen:2022-07-04 05:52:44 UTC
Last seen:2022-07-04 06:40:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:yC4d6JMwOrLhcF4uBcAn8LqyHUIH8qdxBpOLXRnGFv:g6J+fLun8LDH9cqLOlGFv
Threatray 1'895 similar samples on MalwareBazaar
TLSH T182A4D02DFEF5CD02CA541772C2D650184F71D84AA222D76BF68C93A60E0B7B798C6787
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter GovCERT_CH
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.2423.26312.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62c2807add037e27032e14ba/reports/b9750196-362d-49b5-8e4d-b69ecc7dbe42/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a44af00f-0218-4fa0-88a7-8f52e878ff43
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1023881
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 656372 Sample: Purchase List.exe Startdate: 04/07/2022 Architecture: WINDOWS Score: 76 19 Multi AV Scanner detection for submitted file 2->19 21 Yara detected AntiVM3 2->21 23 .NET source code contains potential unpacker 2->23 25 4 other signatures 2->25 6 Purchase List.exe 3 2->6         started        process3 file4 17 C:\Users\user\...\Purchase List.exe.log, ASCII 6->17 dropped 9 Purchase List.exe 6->9         started        11 Purchase List.exe 6->11         started        13 Purchase List.exe 6->13         started        15 2 other processes 6->15 process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f301558cfe40a9902af0ae4b404259541cc1a810e14d42cf2210317b800213b5/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-07-04 04:57:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
22 of 26 (84.62%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6mavldh6icuzakxqvzfuaqszkqomdkaq4fguftzccayxxaacco2q._file
Verdict:
unknown
Similar samples:
0bf294fa8036aaa1c481756b521a5d30093b7bb588b0b8842456bf9d3443ea1f
387a765e811e6e32560ac2664259463d0a59284b34dbc43bdaf3bfcca250bd4d
6b7c57bf4436d26fb957f0bdbd399df30e7e5b20f2c78f01b47cf0c06f3fa54f
6cfbf205225e6ba71eb7f9d214e2d93d932946eb7ff5821f9027c589a4e2ae77
77c8229ca84c4dcc76e71af9dfd376baeb9f45595989b5b24dfd57892f314900
8ab8e038fb9d3581161593d14a73eeef265a10c31b47e338c9f2b54ccc6016fd
98fc829dfe226972ab5ef313fc593c427656737ccd0a72dd99cc3c340ea6d226
9b97e64d40e81141d4cdae8e350c4d8b43addef9dfea1392fae691402d7bb94b
b95fffa4b998dfd7fd76b71740219057610d517bddf6d9f1fdbdfc329c714e9b
f77b7a53564f8553d56104dc2ef6e13a18aceeee08365418c2181cfc765279b8
+ 1'885 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220704-glathsehbn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
a5277f5de2d42780be59e476b2c097f56494e3bd1afc386c943a07ee8b015fd4
MD5 hash:
83c41c596f941a6cab757123f50c54a7
SHA1 hash:
ae1316265846932c5c3e2a676aa031a807f35468
Link:
https://www.unpac.me/results/3e3fe65e-d39d-4fdb-88fb-85fd90836bcb/
SH256 hash:
c8fcd66eb90b32458a0d21d97780c28d2ae4f012500819bd529afee5686aa7f8
MD5 hash:
7c84becc14d3da6c854f766700dbcaaa
SHA1 hash:
ad173ac41dba30081e0739659da8f046a0745517
Link:
https://www.unpac.me/results/3e3fe65e-d39d-4fdb-88fb-85fd90836bcb/
SH256 hash:
70bb4f8aa7d0a33f8206f78c845fa2bd686c2a0f2b3bd50cd0b6b887a45398ca
MD5 hash:
30d61a3a3e26c2bca2eb766990132d7c
SHA1 hash:
94f9742d5f21b13f7d8d194fe938193cbb6a0d4d
Link:
https://www.unpac.me/results/3e3fe65e-d39d-4fdb-88fb-85fd90836bcb/
SH256 hash:
3b59fe180dd50e3f3d4fdcbdd4e7a2d4e3e1c85ae43cb4f3716c4be41e9ec2ae
MD5 hash:
9ea556e333e216a65aa09c102f36004f
SHA1 hash:
814c07f1dc68bd61840384aac3aa8346d9f8148f
Link:
https://www.unpac.me/results/3e3fe65e-d39d-4fdb-88fb-85fd90836bcb/
SH256 hash:
da49080d18d5db0d0426eb61b5240a977e601c01b47fdb9e2b15db99916e49df
MD5 hash:
36ea0bd4c7332c405f7e3dd6111634d0
SHA1 hash:
47e8179de5580ffbc70d66271636fa15470bdc67
Link:
https://www.unpac.me/results/3e3fe65e-d39d-4fdb-88fb-85fd90836bcb/
SH256 hash:
f301558cfe40a9902af0ae4b404259541cc1a810e14d42cf2210317b800213b5
MD5 hash:
c2fd7aca9c671ccdfca82f7d0c2d2d0c
SHA1 hash:
5f0b6aebaa13b73c5cd36a20f066c39df1dd4543
Link:
https://www.unpac.me/results/3e3fe65e-d39d-4fdb-88fb-85fd90836bcb/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Executable exe f301558cfe40a9902af0ae4b404259541cc1a810e14d42cf2210317b800213b5

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments