MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f3a47b8fdddf8c8f83ce7a337d32400002137f36d52d60ec5553339369e8bb28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | f3a47b8fdddf8c8f83ce7a337d32400002137f36d52d60ec5553339369e8bb28 |
|---|---|
| SHA3-384 hash: | 9bbc275d24c455506b32d9bac604233c25327776ec0eafbba33002c64b1683994d8af9d3ccd98e2d29d1135b8dc1ccb7 |
| SHA1 hash: | 128c78f640f3dc0204fbed0b95ba46e934dc2057 |
| MD5 hash: | b6a5339906bcf5e07c8e46fd512ae2da |
| humanhash: | ohio-asparagus-connecticut-purple |
| File name: | Screenshot0091.exe |
| Download: | download sample |
| File size: | 69'952 bytes |
| First seen: | 2020-10-13 12:27:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 1536:uD0Xd07jwimmE1gw13j9eOUc7qTc+vsDVLxUf/:uD0Xd07UimmE1gw13j9eOhJg |
| Threatray | 2 similar samples on MalwareBazaar |
| TLSH | B8630C88E919CD20CEB7DF3EE6C3C4A506F83157562DD2A56EDA5EE078B13541B2CE02 |
| Reporter |  abuse_ch |
| Tags: | exe Hostwinds |
abuse_ch
Malspam distributing unidentified malware:HELO: hwsrv-785563.hostwindsdns.com
Sending IP: 192.255.235.153
From: Peter Bruns <peter.bruns.kwb.eu@mail.ru>
Subject: RE: KWB OUTSTANDING ORDERS
Attachment: Screenshot0091.lha (contains "Screenshot0091.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Launching a process
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Creating a file
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
5 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
ByteCode-MSIL.Trojan.Vimditator
Status:
Malicious
First seen:
2020-10-13 11:07:03 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
f3a47b8fdddf8c8f83ce7a337d32400002137f36d52d60ec5553339369e8bb28
MD5 hash:
b6a5339906bcf5e07c8e46fd512ae2da
SHA1 hash:
128c78f640f3dc0204fbed0b95ba46e934dc2057
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe f3a47b8fdddf8c8f83ce7a337d32400002137f36d52d60ec5553339369e8bb28
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.