MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8772cdb43863d0cc2dcd82eb5af5f27b2571b833bc52d8506f88c95989c6e89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8772cdb43863d0cc2dcd82eb5af5f27b2571b833bc52d8506f88c95989c6e89
SHA3-384 hash: 636109b5541ff60cdefd439a2d612df96c8a3d7122019865d204f11700080b57f4a8ac6ec73d09779cfe3aa6347d1d32
SHA1 hash: 4c6356d4cdb45c1948495ae8af6b375c7c99bf76
MD5 hash: aa2b0dca5ce20d92aa49ff009587f8bf
humanhash: romeo-mike-comet-alpha
File name:SecuriteInfo.com.MachO_File_pyinstaller.24186.22624
Download: download sample
File size:13'746'176 bytes
First seen:2022-08-31 08:45:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a6cec5b1a631d592d80900ab7e1de8df (3 x IRCbot, 3 x CobaltStrike, 3 x RedLineStealer)
ssdeep 196608:f+GKfyXJVWyGdletVyCKwYEueYw04T7cKMUuSPz1RSa176dgrl7kTZ0rGKGD:Q63DNtVyCKWY3JrMTSi7/rl7keq1
TLSH T117D6332D33156FA9D429D13BF8620234B3F2AC420741D5DB63F78E988AAE5D79D36390
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 8e9a9c52620e1e63 (1 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
256
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MachO_File_pyinstaller.24186.22624.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/36134/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/630f1fdefbf1afa4927b2076/reports/c26db243-6d88-4db4-bfed-7cb701967548/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1061438
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8772cdb43863d0cc2dcd82eb5af5f27b2571b833bc52d8506f88c95989c6e89/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zb3szw2dqy6qzqw43axlll27e6zfog4dhpcs3big7cgjlge4n2eq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/220831-kpa58sddb3/
Unpacked files
SH256 hash:
c8772cdb43863d0cc2dcd82eb5af5f27b2571b833bc52d8506f88c95989c6e89
MD5 hash:
aa2b0dca5ce20d92aa49ff009587f8bf
SHA1 hash:
4c6356d4cdb45c1948495ae8af6b375c7c99bf76
Link:
https://www.unpac.me/results/e7f1e228-ee44-4c10-ba3b-27d0c8a5d8bf/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments