MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d8a94a6639ce0c091363a25f027df4d30bb0b6d9d8a3039e931ad1f5c629480. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d8a94a6639ce0c091363a25f027df4d30bb0b6d9d8a3039e931ad1f5c629480
SHA3-384 hash: 2ce58832f3e42a1d9e010482f536cb5a453f3ff8871ab56c5c99cab3f3502a13e85ec9a3cb3a7b4bf09b63b3c4e917ce
SHA1 hash: b95821e718908535903ae4e9aee850af22a63206
MD5 hash: 61df5bd677361765915aeee63c6b2b32
humanhash: jig-yellow-whiskey-equal
File name:SecuriteInfo.com.Win64.DropperX-gen.20149.32584
Download: download sample
File size:237'568 bytes
First seen:2025-02-15 13:08:30 UTC
Last seen:2025-03-31 23:27:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8ef813bfd5616d4aa74fbac6415b903e
ssdeep 6144:ieXcxOMcoFJt9w3YZ4htPEKbcEmfT/ZBk:ijx5coFJt9woZ4vvTmfTfk
TLSH T195347D1973940CF4E8B79139C9514A02EBB2B8164761EBCF03E04696DF277D19D3EB61
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
631
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win64.DropperX-gen.20149.32584.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67b0933328ab76d43a5afea2
Tags:
dropper virus shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Running batch commands
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Сreating synchronization primitives
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expand fingerprint golang lolbin microsoft_visual_cc obfuscated packed
Link:
https://www.filescan.io/uploads/67b091fb0f344d3bea9b956e/reports/419f78f3-1375-4e1f-88a3-ad8bb78ad25e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0d8a94a6639ce0c091363a25f027df4d30bb0b6d9d8a3039e931ad1f5c629480
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c1866895-1f3b-46d4-8bd6-e16402bd4a2a
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1615783
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Bypasses PowerShell execution policy
Found API chain indicative of debugger detection
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1615783 Sample: SecuriteInfo.com.Win64.Drop... Startdate: 15/02/2025 Architecture: WINDOWS Score: 96 38 raw.githubusercontent.com 2->38 40 gogo.fechrise.fun 2->40 42 github.com 2->42 56 Suricata IDS alerts for network traffic 2->56 58 Antivirus / Scanner detection for submitted sample 2->58 60 Multi AV Scanner detection for dropped file 2->60 62 3 other signatures 2->62 8 SecuriteInfo.com.Win64.DropperX-gen.20149.32584.exe 1 17 2->8         started        13 bot.exe 2->13         started        15 bot.exe 2->15         started        signatures3 process4 dnsIp5 44 github.com 140.82.121.4, 443, 49737 GITHUBUS United States 8->44 46 raw.githubusercontent.com 185.199.109.133, 443, 49739 FASTLYUS Netherlands 8->46 34 C:\WCJCI\bot.exe, PE32+ 8->34 dropped 36 C:\Users\user\AppData\Local\...\bot[1].exe, PE32+ 8->36 dropped 64 Found API chain indicative of debugger detection 8->64 66 Adds a directory exclusion to Windows Defender 8->66 17 cmd.exe 1 8->17         started        20 cmd.exe 1 8->20         started        22 cmd.exe 1 8->22         started        24 16 other processes 8->24 file6 signatures7 process8 dnsIp9 50 Adds a directory exclusion to Windows Defender 17->50 27 powershell.exe 23 17->27         started        30 powershell.exe 23 20->30         started        32 powershell.exe 23 22->32         started        48 gogo.fechrise.fun 95.216.227.249, 49776, 49778, 49779 HETZNER-ASDE Germany 24->48 52 Multi AV Scanner detection for dropped file 24->52 54 Bypasses PowerShell execution policy 24->54 signatures10 process11 signatures12 68 Loading BitLocker PowerShell Module 30->68
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0d8a94a6639ce0c091363a25f027df4d30bb0b6d9d8a3039e931ad1f5c629480
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d8a94a6639ce0c091363a25f027df4d30bb0b6d9d8a3039e931ad1f5c629480/
Threat name:
Win64.Trojan.Cerbu
Create hunting rule
Status:
Malicious
First seen:
2025-02-14 14:25:38 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
21 of 37 (56.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bwfjjjtdttqmbejwhis7aj67juylwc3ntwfdaopjggwr6xdcssaa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/250215-qdvndsske1/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fbb22e0c-1ef8-48b5-b734-2e30f8c447ab
Unpacked files
SH256 hash:
0d8a94a6639ce0c091363a25f027df4d30bb0b6d9d8a3039e931ad1f5c629480
MD5 hash:
61df5bd677361765915aeee63c6b2b32
SHA1 hash:
b95821e718908535903ae4e9aee850af22a63206
Link:
https://www.unpac.me/results/91b64538-d506-41ca-920c-67c84105f1a2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d8a94a6639ce0c091363a25f027df4d30bb0b6d9d8a3039e931ad1f5c629480

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 0d8a94a6639ce0c091363a25f027df4d30bb0b6d9d8a3039e931ad1f5c629480

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3440663/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::FreeSid
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::CheckTokenMembership
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExA
SHELL32.dll::ShellExecuteA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::CloseHandle
WININET.dll::InternetCloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleWindow
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegSetValueExA

Comments