MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fa377574c99698cd65d8897d93e96c287dff271d4838107aeac36e7a843c1053. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | fa377574c99698cd65d8897d93e96c287dff271d4838107aeac36e7a843c1053 |
|---|---|
| SHA3-384 hash: | 71f17e80d52e28788c830dca93a6cf7269694fd78c98c0be283fb7dd16c86d65bae53bed29514c2f053e95ca90c48545 |
| SHA1 hash: | 8b18f74b9300dc03df7f826e65d424320cd5cd53 |
| MD5 hash: | e06bfb1a6b645d6437051b4ba950a92e |
| humanhash: | single-lemon-ohio-single |
| File name: | e06bfb1a6b645d6437051b4ba950a92e.exe |
| Download: | download sample |
| File size: | 508'416 bytes |
| First seen: | 2020-07-13 06:58:24 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger) |
| ssdeep | 12288:zLiM3xBB5wV0JGk7rikZZY83Q2EmhpXXXXX3DXXXXXX3XYXXXXXXX3XXX83XXXXW:zJ20GkXiSY836mbXXXXX3DXXXXXX3XYd |
| Threatray | 40 similar samples on MalwareBazaar |
| TLSH | 94B469C82BCF9525EEC845B62E3FAE46213D5843270D927323752F789A3D904EB83567 |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
DNS request
Using the Windows Management Instrumentation requests
Creating a window
Reading Telegram data
Reading critical registry keys
Sending a TCP request to an infection source
Stealing user critical data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-13 07:00:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 30 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery spyware
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Checks for installed software on the system
Checks for installed software on the system
Reads user/profile data of web browsers
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe fa377574c99698cd65d8897d93e96c287dff271d4838107aeac36e7a843c1053
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.