MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 071bdf8e4f341ce433d931e3c95fc080d2df0b0cbf1b5b9868cc82e72a69b9fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 071bdf8e4f341ce433d931e3c95fc080d2df0b0cbf1b5b9868cc82e72a69b9fe
SHA3-384 hash: 4d8fc1814987c803ed8bb3e4d1e0afbdc5bd386caecf35e89df4e775f024f067cacd068ac4aff63fd5b3e24f3cd1c612
SHA1 hash: 9d2d877807c0af43f4b610c13e6beb3c35926590
MD5 hash: 567696f84d52fd6a9514455f61c83ac2
humanhash: solar-video-july-sierra
File name:RAT.bin
Download: download sample
File size:1'006'227 bytes
First seen:2025-04-11 09:43:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c9adc83b45e363b21cd6b11b5da0501f (82 x ArkeiStealer, 60 x RecordBreaker, 46 x RedLineStealer)
ssdeep 24576:+AT8QE+kpbfy12JwPqIiLnxrXNILtydhIixsWeV+:+AI+oLU2+PqfDVWLty3dsS
Threatray 8 similar samples on MalwareBazaar
TLSH T1D625F21571021773E14329700C9FD2B67936EE545129D9CEB2E93F0E8A723AA12EE35F
TrID 94.7% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
2.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.4% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
0.6% (.EXE) Win32 Executable (generic) (4504/4/1)
0.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon 78f0f0d4dcc8c8dc (6 x Formbook, 6 x AsyncRAT, 3 x AgentTesla)
Reporter KodaDr
Tags:exe RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
459
Origin country :
RU RU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Журнал регистрации договоров.bin
Verdict:
No threats detected
Analysis date:
2025-04-11 07:33:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a303d31d-93ba-49a0-b4e5-71854c8f9ff0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/1833/
Detection(s):
Win.Malware.Autoit-8998052-0
Create hunting rule

SecuriteInfo.com.PSW.Generic8.ISF.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f8e5721dba888a93d05395
Tags:
autorun delphi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Delayed reading of the file
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Searching for synchronization primitives
Using the Windows Management Instrumentation requests
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint installer lolbin masquerade overlay packed packer_detected schtasks
Link:
https://www.filescan.io/uploads/67f8e46beb7eb0aee0439749/reports/3b190f4b-bc74-4de3-9f09-50960789a9cc/overview
Verdict:
Malicious
Labled as:
Malware_42.6
Link:
https://www.hybrid-analysis.com/sample/071bdf8e4f341ce433d931e3c95fc080d2df0b0cbf1b5b9868cc82e72a69b9fe
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/189a9384-17ce-46ef-8e0d-726d798a0a0e
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1662996
Signature
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (changes PE section rights)
Drops PE files with a suspicious file extension
Found stalling execution ending in API Sleep call
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global get message hook
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Rar Usage with Password and Compression Level
Sigma detected: Suspicious Binary Writes Via AnyDesk
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the nircmd tool (NirSoft)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1662996 Sample: RAT.bin.exe Startdate: 11/04/2025 Architecture: WINDOWS Score: 100 85 vniir.nl 2->85 87 www.4t-niagara.com 2->87 89 3 other IPs or domains 2->89 97 Antivirus detection for URL or domain 2->97 99 Multi AV Scanner detection for dropped file 2->99 101 Multi AV Scanner detection for submitted file 2->101 103 6 other signatures 2->103 9 RAT.bin.exe 292 7 2->9         started        12 svchost.exe 2->12         started        15 nircmd.exe 2->15         started        17 7 other processes 2->17 signatures3 process4 dnsIp5 81 C:\Users\user\Window\curl.exe, PE32 9->81 dropped 20 cmd.exe 2 9->20         started        22 cmd.exe 2 9->22         started        26 cmd.exe 1 9->26         started        30 20 other processes 9->30 119 Changes security center settings (notifications, updates, antivirus, firewall) 12->119 28 cmd.exe 15->28         started        83 127.0.0.1 unknown unknown 17->83 file6 signatures7 process8 file9 32 driver.exe 20->32         started        35 driver.exe 20->35         started        38 AnyDesk.exe 20->38         started        46 9 other processes 20->46 79 C:\Users\user\Window\ghost.cmd, ASCII 22->79 dropped 115 Uses schtasks.exe or at.exe to add and modify task schedules 22->115 40 conhost.exe 22->40         started        42 conhost.exe 26->42         started        49 9 other processes 28->49 44 conhost.exe 30->44         started        51 18 other processes 30->51 signatures10 process11 dnsIp12 61 C:\Users\user\Window\Trays\unins000.exe, PE32 32->61 dropped 73 7 other malicious files 32->73 dropped 63 C:\Users\user\Window\nircmd.exe, PE32+ 35->63 dropped 65 C:\Users\user\Window\next.exe, PE32 35->65 dropped 67 C:\Users\user\Window\blat.exe, PE32 35->67 dropped 75 3 other malicious files 35->75 dropped 105 Drops PE files with a suspicious file extension 35->105 69 C:\Users\user\Window\AnyDesk\AnyDesk.exe, PE32 38->69 dropped 107 Detected unpacking (changes PE section rights) 38->107 109 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->109 53 AnyDesk.exe 38->53         started        56 AnyDesk.exe 38->56         started        93 mail.vniir.nl 92.63.173.61, 49724, 49726, 80 ASTRALUSNL Netherlands 46->93 95 www.4t-niagara.com 94.23.158.211 OVHFR France 46->95 71 C:\Users\user\Window\driver.exe, PE32 46->71 dropped 77 2 other malicious files 46->77 dropped 111 Found stalling execution ending in API Sleep call 46->111 113 Installs a global get message hook 46->113 58 4t-min64.exe 46->58         started        file13 signatures14 process15 dnsIp16 91 92.223.88.41 GCOREAT Austria 53->91 117 Installs a global get message hook 58->117 signatures17
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/071bdf8e4f341ce433d931e3c95fc080d2df0b0cbf1b5b9868cc82e72a69b9fe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/071bdf8e4f341ce433d931e3c95fc080d2df0b0cbf1b5b9868cc82e72a69b9fe/
Threat name:
Win32.Backdoor.RaBased
Create hunting rule
Status:
Malicious
First seen:
2025-04-11 09:14:02 UTC
File Type:
PE (Exe)
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a4n57dspgqooim6zghr4sx6aqdjn6cymx4nvxgdizsbooktjxh7a._file
Verdict:
malicious
Label(s):
admintool_nircmd
Create hunting rule
Similar samples:
071bdf8e4f341ce433d931e3c95fc080d2df0b0cbf1b5b9868cc82e72a69b9fe
d37415009a9079333e3ff6e20884063148db018e6be383fc5532109712b054b7
de998bd26ea326e610cc70654499cebfd594cc973438ac421e4c7e1f3b887617
error
f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
fe261013faaf34429df7459f6d1ba9e1f2fc9def540976cfa11a6b653f1f20d3
Result
Malware family:
n/a
Score:
  9/10
Tags:
credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/250411-lqkazawky2/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Adds Run key to start application
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads ssh keys stored on the system
Reads user/profile data of web browsers
Downloads MZ/PE file
Modifies Windows Firewall
Sets file to hidden
OS Credential Dumping: Security Account Manager
Verdict:
Malicious
Tags:
Win.Malware.Autoit-8998052-0
YARA:
n/a
Link:
https://app.threat.zone/submission/6315048a-730d-4516-b02f-4af2617e14af
Unpacked files
SH256 hash:
071bdf8e4f341ce433d931e3c95fc080d2df0b0cbf1b5b9868cc82e72a69b9fe
MD5 hash:
567696f84d52fd6a9514455f61c83ac2
SHA1 hash:
9d2d877807c0af43f4b610c13e6beb3c35926590
Link:
https://www.unpac.me/results/9381ddaa-3aa9-4277-b4a2-c22599fa7692/
SH256 hash:
64134900210811f21cde47a18742125ac74e52014e316f7680f295868db1e9cc
MD5 hash:
0750892b9ca24f7a14d1aa1f22b95c7d
SHA1 hash:
71507ea700dd1ff6bab9cb86e99c76e304f00933
Link:
https://www.unpac.me/results/9381ddaa-3aa9-4277-b4a2-c22599fa7692/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/071bdf8e4f341ce433d931e3c95fc080d2df0b0cbf1b5b9868cc82e72a69b9fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.hybrid-analysis.com/sample/071bdf8e4f341ce433d931e3c95fc080d2df0b0cbf1b5b9868cc82e72a69b9fe
Cape
Cape
https://www.capesandbox.com/analysis/1833/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User Authorizationadvapi32.dll::AllocateAndInitializeSid
advapi32.dll::EqualSid
advapi32.dll::FreeSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediagdi32.dll::StretchDIBits
winmm.dll::timeKillEvent
winmm.dll::timeSetEvent
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
advapi32.dll::GetTokenInformation
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExA
shell32.dll::ShellExecuteA
shell32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and Threadsadvapi32.dll::OpenProcessToken
kernel32.dll::OpenProcess
advapi32.dll::OpenThreadToken
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::TerminateProcess
kernel32.dll::LoadLibraryA
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::WinExec
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::GetWindowsDirectoryA
kernel32.dll::GetSystemDirectoryA
kernel32.dll::GetFileAttributesA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
advapi32.dll::GetUserNameA
advapi32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegCreateKeyExA
advapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryInfoKeyA
advapi32.dll::RegQueryValueExA
advapi32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments