MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07b28ff80268d19ea2e8fad3d86f5b9608b5a3d24336af10a93b8aa0ed2fd07b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07b28ff80268d19ea2e8fad3d86f5b9608b5a3d24336af10a93b8aa0ed2fd07b
SHA3-384 hash: a8acfba853d8ae63c94c4aad3c800de963f001adbbd54f472c3709367950e59de02743b0019dd964c9e65508ef31b417
SHA1 hash: 281bb821bcdf78374218c94bc7ac4bb63081ca09
MD5 hash: 2b6e0c3d7e5b6887cdfa1eddc0fdf885
humanhash: uniform-bluebird-apart-speaker
File name:SecuriteInfo.com.BScope.Trojan.Meterpreter.10219.9994
Download: download sample
File size:567'808 bytes
First seen:2023-10-06 08:36:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b42856b54645aa24809a30270d5556cf (2 x Rhadamanthys)
ssdeep 6144:kwV2zb9+pn3BjAVkFVWwKgWfK948r40OZuW0SEkqZt8DPozcv/4Bx1ErHm1AIQVd:xi4pn3BCkFVRKgWS948r40OZhNhDr
TLSH T115C41820BA95C436E6B3DFB34CB886676C2C78D10F34D4CB62841A5E9D775C26A31B1B
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon d2d108a6d26a6c74 (2 x Rhadamanthys)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BScope.Trojan.Meterpreter.10219.9994.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Gathering data
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
control greyware lolbin masquerade remote
Link:
https://www.filescan.io/uploads/651fc7307e001f82cf782203/reports/9ad71031-53d0-4f59-a15a-e5644c6ba558/overview
Verdict:
Malicious
Labled as:
BScope.Trojan
Link:
https://www.hybrid-analysis.com/sample/07b28ff80268d19ea2e8fad3d86f5b9608b5a3d24336af10a93b8aa0ed2fd07b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/93161edb-bb90-40a4-8f5f-bdea16c10d52
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1320800
Signature
Antivirus detection for URL or domain
Contains functionality to prevent local Windows debugging
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07b28ff80268d19ea2e8fad3d86f5b9608b5a3d24336af10a93b8aa0ed2fd07b/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a6zi76acndiz5ixi7lj5q323syelli6sim3k6efjhofkb3jp2b5q._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231006-kh5q9scc35/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
07b28ff80268d19ea2e8fad3d86f5b9608b5a3d24336af10a93b8aa0ed2fd07b
MD5 hash:
2b6e0c3d7e5b6887cdfa1eddc0fdf885
SHA1 hash:
281bb821bcdf78374218c94bc7ac4bb63081ca09
Link:
https://www.unpac.me/results/841aa8c4-8f91-4786-b7a7-98adcd54b2bf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/07b28ff80268d19ea2e8fad3d86f5b9608b5a3d24336af10a93b8aa0ed2fd07b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 07b28ff80268d19ea2e8fad3d86f5b9608b5a3d24336af10a93b8aa0ed2fd07b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2717098/
  
Delivery method
Distributed via web download

Comments