MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fd8d0936c29133e62a9bbfdbe89ebffa45f2601a62ff5bb931e6a172f40108d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | fd8d0936c29133e62a9bbfdbe89ebffa45f2601a62ff5bb931e6a172f40108d8 |
|---|---|
| SHA3-384 hash: | 54b8f440004d4a3d453d3e220f8d565bf2125aca55854ee61ad957731aac8f7b2539fcfed2df53a3130d0ab7f69a3764 |
| SHA1 hash: | 14698cb142c5665ea10b9b4817f3705f67f9baee |
| MD5 hash: | 26d3d8794ffbd75579a8a5d8d079fa84 |
| humanhash: | sixteen-undress-potato-carolina |
| File name: | 26d3d8794ffbd75579a8a5d8d079fa84.exe |
| Download: | download sample |
| File size: | 1'014'006 bytes |
| First seen: | 2021-01-15 15:42:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat) |
| ssdeep | 24576:Y2G/nvxW3WsTIWzqlqaHbpbkF6nXyho5L4qEfCW4KF6PXyGo5pq1f03w:YbA3DzzI/JkwGULhE7w1UE183w |
| Threatray | 366 similar samples on MalwareBazaar |
| TLSH | 9E251242BDC199B3D2710C31555DAB2161BDBC211F14AFEBA3D06E9DE6302C0AB35BA7 |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
DNS request
Sending a custom TCP request
Creating a process with a hidden window
Launching a process
Using the Windows Management Instrumentation requests
Sending a UDP request
Running batch commands
Sending an HTTP GET request
Reading critical registry keys
Changing a file
Replacing files
Creating a file
Deleting a recently created file
Unauthorized injection to a recently created process
Delayed reading of the file
Moving a recently created file
Launching a tool to kill processes
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
phis.troj.evad
Score:
80 / 100
Signature
Antivirus detection for URL or domain
Modifies Chrome's extension installation force list
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: MSHTA Spawning Windows Shell
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Rasftuby
Status:
Malicious
First seen:
2021-01-08 08:28:17 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 356 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
spyware
Behaviour
Kills process with taskkill
Modifies Internet Explorer settings
Runs .reg file with regedit
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
fd8d0936c29133e62a9bbfdbe89ebffa45f2601a62ff5bb931e6a172f40108d8
MD5 hash:
26d3d8794ffbd75579a8a5d8d079fa84
SHA1 hash:
14698cb142c5665ea10b9b4817f3705f67f9baee
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe fd8d0936c29133e62a9bbfdbe89ebffa45f2601a62ff5bb931e6a172f40108d8
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.