MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6
SHA3-384 hash:	9471a8c6618b534f7f9e40675cbc5d771233510c7d42fc48daf74807f8b95f94680fccc1fecb29b38c1f1bd925135880
SHA1 hash:	f44365fa8ca9aeebb5d01ca86865bf26b7251a70
MD5 hash:	52c2d785984358485ba5d5f946c1ba63
humanhash:	mexico-ohio-north-wolfram
File name:	rat.exe
Download:	download sample
File size:	9'037'312 bytes
First seen:	2025-04-07 08:45:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e49108ddcc94d3a4a3aa4740d05d7ddd
ssdeep	196608:BlFyJA06kqDGwTYW0vycMbr5ECDBdf8/ledTcYAVgoftCQ7D:jFyJAJkeGUuaLb1ldKlQtAB7D
TLSH	T1279633D86D4315A2CC8FDB713359EC7C31BD6BB98A6CCD67A40D605BFCA7629103980A
TrID	37.3% (.EXE) Win64 Executable (generic) (10522/11/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

21f6f2fe_main

Verdict:

Suspicious activity

Analysis date:

2025-04-07 12:06:56 UTC

Tags:

arch-exec arch-doc github

Link:

https://app.any.run/tasks/c1993b81-eda2-4e4b-a603-776423a0eeb6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/987/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f390b9e011fe619fabdf10

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed packed packer_detected

Link:

https://www.filescan.io/uploads/67f390b22d430c849e0a1ec1/reports/ced50af1-2b19-4f69-b801-59a03417feed/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/103006e2-62c9-475d-9981-ed89c6671def

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1658116

Signature

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Switches to a custom stack to bypass stack traces

Tries to evade analysis by execution special instruction (VM detection)

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6/

Threat name:

Win32.Malware.Heuristic

Status:

Malicious

First seen:

2025-04-07 08:45:16 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zsjbsmyufit6lkmo2y55fssteost4cb6r6px6xav3inyl2wco33a._file

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery

Link:

https://tria.ge/reports/250407-kn35matzez/

Behaviour

Suspicious behavior: EnumeratesProcesses

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Legitimate hosting services abused for malware hosting/C2

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a201ed0b-0553-4c1a-bcbf-cc74bac68d68

Unpacked files

SH256 hash:

cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6

MD5 hash:

52c2d785984358485ba5d5f946c1ba63

SHA1 hash:

f44365fa8ca9aeebb5d01ca86865bf26b7251a70

Link:

https://www.unpac.me/results/db0e49e0-e623-42e4-ab43-b4a343ab3cea/

SH256 hash:

0fc9a4bc0fc31d0fc6d51f503ef04dca63ceab62973a6115e157299260de6b93

MD5 hash:

099a1b61e8772cf597daf1b3ebfda713

SHA1 hash:

44a9be0544e2827ef9788c8ce2d480174b445da5

Detections:

INDICATOR_TOOL_PWS_Blackbone

Link:

https://www.unpac.me/results/db0e49e0-e623-42e4-ab43-b4a343ab3cea/

SH256 hash:

31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427

MD5 hash:

9ab9f3b75a2eb87fafb1b7361be9dfb3

SHA1 hash:

fe10018af723986db50701c8532df5ed98b17c39

Detections:

VULN_PUA_GIGABYTE_Driver_Jul22_1

PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4

Link:

https://www.unpac.me/results/db0e49e0-e623-42e4-ab43-b4a343ab3cea/

Parent samples :

262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057
185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b
7a976388b064594086b73e3e08a3b95b97a9eea7610bf9c4ac53a2d10304e12b
7b4ca5b780438bef6eca1d5241c5a5f9afbed7e9eacc62300c5ac64fe9e1030a
cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6
638bfb452ad5c2ce2bc9aab6a7dd65665b886d79abd1ce66e617d33781036764
7409f72c3bec45343af484f26fefee09ec591ddc2f87aaff261337209dcbedc4
884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf
4bf19e234784a69a8e42fa345a703af865dbf4b58342af810dc51d5d902211c8
2d3272c4e2daca9621f56b0724743c467a8a70cd30826b505bb7c3d3a1dfd482
cab05e6b1c523c1c04f1c8806bcb1f1a0e2418f8179f57db80aa1dc5cd939844
f2943a108d98faef6c3411f0ad1235f85f3196cff70cd7d48565c92d0a21d060
3a9fe422216a414d420cbd1e20186da127fb5be80d50f40ef7db6215b7feb2f1
ed980429e185979a8bf0e6f71c3d16b61e0845189dd18785dcd94163566e2f51
2bd7ca44d7dc856bc104eefb0a01f3779bd61224b16c03d56dee1bffc8c08581
cbb5470f103fe2ef9344dbd99f892fd31f687c62225abdfaa76d3eea8b36feb4

SH256 hash:

0edc8ad4674254be9560905509c6843ac15ca96ad27e6d2d3b470bfcaa39959d

MD5 hash:

d2e3b613acae26ef98ba4e368bcb16a3

SHA1 hash:

e950214c58a00fe7876bd1839cd2dccae6f7054d

Detections:

HTKL_BlackBone_DriverInjector

INDICATOR_TOOL_PWS_Blackbone

Link:

https://www.unpac.me/results/db0e49e0-e623-42e4-ab43-b4a343ab3cea/

SH256 hash:

6a0f63e25a08be44a365703ef5ad47a1bdd43100f24684e541291cdf98c66334

MD5 hash:

53d3da0903ac6d8e2bef6e6f8c54a6c3

SHA1 hash:

416edd15a889a3a087c11a384bde8b6da00926bf

Link:

https://www.unpac.me/results/db0e49e0-e623-42e4-ab43-b4a343ab3cea/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.63

Link:

https://yomi.yoroi.company/submissions/cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/987/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::DeleteFileW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegOpenKeyW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample