MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 13

Intelligence 13 IOCs YARA 3 File information Comments

SHA256 hash:	11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7
SHA3-384 hash:	d922068e7987ac8495719e591a961c0607ec04e5a9c3fcb2375de94f074e3fc60f7f857ee6056be58f52d8e595786517
SHA1 hash:	ce6505c4ff4295ed38ccba649efbfd799f9440b8
MD5 hash:	dbae439a80cd9eb811fe4d4939f2e89f
humanhash:	coffee-ack-oregon-arizona
File name:	cbot.exe
Download:	download sample
File size:	31'232 bytes
First seen:	2025-12-20 10:14:44 UTC
Last seen:	2025-12-20 11:30:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4b2df774f65211b4962a056c4da67248
ssdeep	768:/A9wAsk5uWLfuT98npCJpkoar+XqAjNVXxJfBQeh5DK:/BARu8uhfpkFSqAjNVhJ5Qe3DK
TLSH	T1B3E2E1413FFE6298F0F26EBA22E49605E17DB55A5C4E83892F09805F18E095BCD37E31
TrID	63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12) 24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.8% (.ICL) Windows Icons Library (generic) (2059/9) 1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	BlinkzSec
Tags:	exe UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	31'232 bytes
File size (de-compressed) :	61'440 bytes
Format:	win64/pe
Unpacked file:	91b89db9ca99f750269e13a5ce09ed159c8312faf9587856d6f82c700080ae78

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

PEPacker

a UPX version number and an unpacked binary

Link:

https://research.acce.ciphertechsolutions.com/results/4df03c47-46ef-4c1d-b93e-59f6dac4a119/

Malware family:

n/a

ID:

File name:

cbot.exe

Verdict:

Suspicious activity

Analysis date:

2025-12-20 10:15:32 UTC

Tags:

auto-startup upx

Link:

https://app.any.run/tasks/0f9867ef-5570-4dc7-90d3-ffb4d718a7ca

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/45565/

Detection(s):

SecuriteInfo.com.FileRepMalware.35944859.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6946773eee899ae4567f14f9

Tags:

backdoor autorun botnet virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug barys crypto fake packed packed packed unsafe upx

Link:

https://www.filescan.io/uploads/6946773ca7163552ba0328e6/reports/8d8d869f-4282-4a15-b2cd-9cddc9ac345d/overview

Verdict:

Malicious

Labled as:

Trojan[Ransom]/MSIL.HiddenTear

Link:

https://www.hybrid-analysis.com/sample/11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-12-20T07:13:00Z UTC

Last seen:

2025-12-22T00:54:00Z UTC

Hits:

~100

Detections:

PDM:Trojan.Win32.Generic Trojan.Win32.Reconyc.sb HEUR:Trojan.Win64.Generic RemoteAdmin.LiteManager.TCP.C&C VHO:Trojan.Win32.Agent.gen

Link:

https://opentip.kaspersky.com/11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/68f4fafd-36a2-4bee-a390-11001a391763

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/dbae439a80cd9eb811fe4d4939f2e89f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7/

Verdict:

Malicious

Threat:

RemoteAdmin.LiteManager.TCP

Link:

https://tip.neiki.dev/file/11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2025-12-20 10:15:25 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cfqhyeqr3vikjgzxraxmdx6f2gd3774qqceszvog7wj4bwaio7dq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

upx

Link:

https://tria.ge/reports/251223-nv1jvswlax/

Behaviour

UPX packed file

Drops startup file

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/97abed81-9854-49a7-bf79-180b20204029

Unpacked files

SH256 hash:

11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7

MD5 hash:

dbae439a80cd9eb811fe4d4939f2e89f

SHA1 hash:

ce6505c4ff4295ed38ccba649efbfd799f9440b8

Link:

https://www.unpac.me/results/24426945-3efc-4be1-913b-79e493a175d7/

SH256 hash:

91b89db9ca99f750269e13a5ce09ed159c8312faf9587856d6f82c700080ae78

MD5 hash:

399d8f4627b46bdc03008be842817676

SHA1 hash:

8dda215e8ef87faa118ec55d731cc6646d2ce199

Link:

https://www.unpac.me/results/24426945-3efc-4be1-913b-79e493a175d7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.56

Link:

https://yomi.yoroi.company/submissions/11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.