MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f61fba92541b23921c7904cd689121c68b8bf69780220586227bf01c9816c68d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 2
| SHA256 hash: | f61fba92541b23921c7904cd689121c68b8bf69780220586227bf01c9816c68d |
|---|---|
| SHA3-384 hash: | 8e2b52b9415ca13c83a58ed104ecd48e5869d462586d74a262308baddaa813780f1b531d13e69ab7a3869d91be93691f |
| SHA1 hash: | 11be04fa272a84c092586a9571e0de62fb5dee90 |
| MD5 hash: | a3c4af6e031046ff8ea53b05b5637af7 |
| humanhash: | enemy-potato-equal-kentucky |
| File name: | SecuriteInfo.com.Trojan.GenericKD.43306033.19842.7263 |
| Download: | download sample |
| File size: | 139'264 bytes |
| First seen: | 2020-06-09 20:51:30 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 3072:c61s3wijOEbQpvpcfeZUZUZBdIxoABd3wf0GUeJhj:c6SVjpQBJKKBdIDBd3wf/Ue |
| Threatray | 135 similar samples on MalwareBazaar |
| TLSH | DED3D01137A88B3AD97D47FA90E6300143B2B31BB63BF75D4DCA70E619A2B104791E97 |
| Reporter |  SecuriteInfoCom |
Intelligence
File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-06-08 10:31:00 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 125 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
evasion rezer0 trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Windows security modification
ServiceHost packer
rezer0
Contains code to disable Windows Defender
Modifies Windows Defender Real-time Protection settings
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe f61fba92541b23921c7904cd689121c68b8bf69780220586227bf01c9816c68d
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.