MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fae8881e80b6243384360184e9f60a35155697c280af2440aa8ab7b904a43f4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | fae8881e80b6243384360184e9f60a35155697c280af2440aa8ab7b904a43f4f |
|---|---|
| SHA3-384 hash: | f4e6215437588d240eb12b6d22d6f98437ac68c4379891c680388dada6b6b643ed22a3db4972cb8a7b773d3fdf2804f6 |
| SHA1 hash: | 44196f898ee8cc569d9f42e5c0475163d90a9c11 |
| MD5 hash: | c07d46a3088965525cc2317b5463837f |
| humanhash: | orange-blossom-high-zebra |
| File name: | a0a92f0e7abaf4f9ee466614f241fc58 |
| Download: | download sample |
| File size: | 212'992 bytes |
| First seen: | 2020-11-17 11:33:22 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 03ae0108c7455c49c94d2d60afa1e57a (1 x Worm.Ramnit) |
| ssdeep | 3072:nGwEiU2HUeigtU3+Q4wNHn4/U/vU9JE79YS8MTHKKECkc+5utx4pLthEjQT6j:nG5iKEUsOn49FS5lEhF+xkEj1 |
| Threatray | 42 similar samples on MalwareBazaar |
| TLSH | 42246B017E958453C06747B5D9F34BDB0928BC92AF31A99FB9C073CD2E7AA5C9C183A4 |
| Reporter |  seifreed |
Intelligence
File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the Windows subdirectories
Running batch commands
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Creating a process from a recently created file
Result
Gathering data
Threat name:
Win32.Trojan.Aenjaris
Status:
Malicious
First seen:
2020-11-17 11:35:14 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 32 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Program crash
Drops file in Windows directory
Executes dropped EXE
ServiceHost packer
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
fae8881e80b6243384360184e9f60a35155697c280af2440aa8ab7b904a43f4f
MD5 hash:
c07d46a3088965525cc2317b5463837f
SHA1 hash:
44196f898ee8cc569d9f42e5c0475163d90a9c11
SH256 hash:
a9a88e1d176b9efd56f353b3bc13c9876efeae761153b064899c44ed6ee192c6
MD5 hash:
bb4fd7a9ba1dd1dc194704ab270f029a
SHA1 hash:
9d5a327faa4249d98eb432b28189422daee3cbda
SH256 hash:
d93df34178ac91dfa60ffba19c8cdbd0990257ecf111ae19b78d85f5f33af44e
MD5 hash:
bdd6b62f981019a85a142e4838bee062
SHA1 hash:
607e15f9182d022cc317a92e00a232c86c6ef061
SH256 hash:
a601a341872025d8aa53fd4cdec1781647b410de47aad58faff005699f5486cf
MD5 hash:
05285d2616ca53efaa243be372e96590
SHA1 hash:
b0d8380cb53d9432dbb191630159b9dad64f5558
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.