MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f779c894c6888ba9ce5d0011c1af73dc0f55b087244b3608fd0de3152bf1929a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f779c894c6888ba9ce5d0011c1af73dc0f55b087244b3608fd0de3152bf1929a
SHA3-384 hash: e347ba311c2a96e734a8f4425f87f50f527e582cca385258c6fedf0adf2b1586149386935c06ce96b0a6ac7524e0eae2
SHA1 hash: 12b7a8366a66cc0ce0a680e7f67f8bce128f014b
MD5 hash: a2b167ba0216dc07758727b6c5f2bd0e
humanhash: sad-fifteen-eighteen-steak
File name:a2b167ba0216dc07758727b6c5f2bd0e
Download: download sample
File size:212'992 bytes
First seen:2020-11-17 12:09:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 03ae0108c7455c49c94d2d60afa1e57a (1 x Worm.Ramnit)
ssdeep 3072:dmtrRQ04GoZRyEuTbWGNG1E+6PGbEFrmd3dCjEEphXraJ8M2b0stHiVMYTWdl9i/:dmZJ4GoZGTbWGNG12j94j18DV4kEj1
Threatray 89 similar samples on MalwareBazaar
TLSH 6E248D00B9C6C9A6C02703309DEDD4F156BABD92CFB1A23B6EC4379D59B5282491B773
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Razy-9759519-0
Create hunting rule

Win.Malware.Zusy-9759529-0
Create hunting rule

Win.Trojan.Agent-1381405
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the Windows subdirectories
Running batch commands
Creating a process with a hidden window
Creating a file in the Windows directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f779c894c6888ba9ce5d0011c1af73dc0f55b087244b3608fd0de3152bf1929a/
Threat name:
Win32.Trojan.Aenjaris
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 18:29:58 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
03a54d3b7cf0d1f321fcb5453df8a03ce9578f6c807611ba00ce0fa27711e2c6
1473388d4a4056bbc7ef3a0c2f9dbfedcef34d224efb75a285a70b21e0fa5c81
3fba18cd0da590c6e176aad69b89f3cec04f0f5dccf9a5d9788b5b9321269198
431e04000c1801546db8cf059a636154715eb3ff7f6d715a15f91ac8f94979a0
6b123a7f279751561a329fc9fb56d41fcf7a53d15fc6d0e638099fe9e844d962
784c771b4eeaaf909fba8a13576fa117604ce9bc5e6131b9352888ba6aed77a7
8898ce01761e5d52855090f46470430143457d2ac26993dc1ccf60f68e5443ef
9dd41de95c73c14fe51a5ec3955d93809f7e30dc558bb5d1e47fa2e7ff4be8f9
bcacc8ff565ff1c5450dbcb891ddcec02e1106edcc2ac8af7c5dc880a3aaed5a
fa86d2cd7e9281b198093a0a310c18b326c3dfbeaeb61d7e8ebd7be8a9f8d342
+ 79 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
persistence
Link:
https://tria.ge/reports/201117-kjll599k42/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
ServiceHost packer
Unpacked files
SH256 hash:
f779c894c6888ba9ce5d0011c1af73dc0f55b087244b3608fd0de3152bf1929a
MD5 hash:
a2b167ba0216dc07758727b6c5f2bd0e
SHA1 hash:
12b7a8366a66cc0ce0a680e7f67f8bce128f014b
Link:
https://www.unpac.me/results/3049755b-6146-400c-a643-461bc6a48e90/
SH256 hash:
c88314ac2dd1c61353847f40e31816d0e68dd80a3a58ac9a487a7e9b453a06b3
MD5 hash:
d073c1ea4ecd5b88add505c2dd62abcc
SHA1 hash:
0b64d9ac3ff184fd25bbb61f0cb7074ee7e882a2
Link:
https://www.unpac.me/results/3049755b-6146-400c-a643-461bc6a48e90/
SH256 hash:
b1f628229757f00966f7f10a9df98adb5edb649a44df9f78e72f7dd423208bc8
MD5 hash:
acecece9b183d7dcbb9307361b046a6c
SHA1 hash:
d087f21340167ed4f8c2ef85d76e0a01193ecafd
Link:
https://www.unpac.me/results/3049755b-6146-400c-a643-461bc6a48e90/
SH256 hash:
2ba695e1a73c1cb7afbd8928bd957647921b4898c0902079669731b7298ad9f5
MD5 hash:
cece9b8a934b31eddf02b0f851095479
SHA1 hash:
56c1bcca9102a34505f3c31c8ad28ee4ac98284b
Link:
https://www.unpac.me/results/3049755b-6146-400c-a643-461bc6a48e90/
SH256 hash:
026a81645d1d81366b09c9dc23b620a3570763bf1eca435172b599bca47db766
MD5 hash:
c8aa98557e816c1f5012875d6fe89c64
SHA1 hash:
32b3c35ba7e0bbc7ce8f8db67aa9cdef5302fe84
Link:
https://www.unpac.me/results/3049755b-6146-400c-a643-461bc6a48e90/
SH256 hash:
515797eef79f25ca437602b8207661bf010cf925d5d9b98ff16a0cd4a91fdf48
MD5 hash:
afe09ea4ac53eb0042c265f6b772c0be
SHA1 hash:
0a4281d028f27c0b30eab5c879560b5812438598
Link:
https://www.unpac.me/results/3049755b-6146-400c-a643-461bc6a48e90/
SH256 hash:
d6b6833f08d247f9d291012e9e00029ea80de115694dfc304ad6c867e0f73eee
MD5 hash:
6ac395193dcbd8b61ba2b19ffc9b281d
SHA1 hash:
187f30134d865fb29a0c996d10899073fdcb570f
Link:
https://www.unpac.me/results/3049755b-6146-400c-a643-461bc6a48e90/
SH256 hash:
e0ab52ce07b5a6fd55c6b0644e9e0093984ff8de83d2d51f5abeade951dc1178
MD5 hash:
c31debcb403fcf584ee03a209043ac6b
SHA1 hash:
ee2d6553edf973a6142df47ffdf14572b49ed1fe
Link:
https://www.unpac.me/results/3049755b-6146-400c-a643-461bc6a48e90/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments