MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f854fcbb551c3263588a5bab749800ac92b994ab159c385a224962c44e6fec0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | f854fcbb551c3263588a5bab749800ac92b994ab159c385a224962c44e6fec0e |
|---|---|
| SHA3-384 hash: | d2430c76c613faa70fda3e0884c4259b757200984ae79fb3f8aa23aec099fb0ccbc53aba03ace675fabba255601fd4b6 |
| SHA1 hash: | 52b4599dcdec04ca12d4c7e84c1234a8945277ee |
| MD5 hash: | 3f3ba024d3f8912be5c5b72bd21d3721 |
| humanhash: | whiskey-illinois-zulu-autumn |
| File name: | 3f3ba024d3f8912be5c5b72bd21d3721 |
| Download: | download sample |
| File size: | 9'035'511 bytes |
| First seen: | 2021-11-21 11:27:34 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b4070734502a100c8f90bbd445995533 (11 x CryptOne, 5 x DCRat, 2 x njrat) |
| ssdeep | 196608:YdAfFCoICIdLIa1WniGSH/dGI42EolTelpp9ThtikzEQgYKYf:Y6bICSLIa1wAH/dGI4baTep9hskzwG |
| Threatray | 1'039 similar samples on MalwareBazaar |
| TLSH | T178963323569069B1C0911CB6497ADE7098BEFE10AB27D8EF43D12DABFD3C9D2497C244 |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3f3ba024d3f8912be5c5b72bd21d3721
Verdict:
Malicious activity
Analysis date:
2021-11-21 11:28:18 UTC
Tags:
trojan
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
DNS request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
greyware meterpreter overlay packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
72 / 100
Signature
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Zilla
Status:
Malicious
First seen:
2021-11-15 22:01:11 UTC
AV detection:
17 of 27 (62.96%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 1'029 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
71f615d7a9ea898101eea14c63bd897c9c0333af6650104aa45a0033714d5f76
MD5 hash:
ee863bcd408982a5c00e2c91776810e8
SHA1 hash:
b474f3165d37733b886cea7031c0e8f5ca8ede29
SH256 hash:
e3d8de68ec316c3b1601b48fa6180ce75f3024575b81b1fbbf0004689d2f698f
MD5 hash:
8ffd0e5acbeb1203b3c90349faaf7bbf
SHA1 hash:
69247cdbbcf718ce0a2e1d97d1cd6790c07ea64a
SH256 hash:
f854fcbb551c3263588a5bab749800ac92b994ab159c385a224962c44e6fec0e
MD5 hash:
3f3ba024d3f8912be5c5b72bd21d3721
SHA1 hash:
52b4599dcdec04ca12d4c7e84c1234a8945277ee
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe f854fcbb551c3263588a5bab749800ac92b994ab159c385a224962c44e6fec0e
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://freegdz.ml/reaper.exe