MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XTinyLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a
SHA3-384 hash: 7f5cdb37e48c2a1f42a63dd0bc3ea332f0902a5881645ad84a8cffc130d7e2834cb2d8ffc9959e7f80530a5efcedc078
SHA1 hash: 4e0cbc4dd051073489d4b6a0b40c651c28dad648
MD5 hash: 6e8354adddf8bd54b877e2d1ea8bb0a8
humanhash: dakota-oregon-blossom-emma
File name:1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a
Download: download sample
Signature XTinyLoader
Create hunting rule
File size:16'896 bytes
First seen:2025-07-31 11:54:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d21c4bba2e4623145b475c957df80f42 (19 x XTinyLoader, 1 x RedLineStealer, 1 x PythonStealer)
ssdeep 384:wUk8UjsZY5GxE5Iu2bPQUd1sRwHQ3ArRK8:whee5GxEKbPQUdmPqs
TLSH T10272F846BC5AD23ACC401CF51EB172B5F7EF9286DDA28497DC409918B835A994F3418E
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter JAMESWT_WT
Tags:exe XTinyLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
24
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
Spotify Checker by KniX.zip
Verdict:
Malicious activity
Analysis date:
2025-07-27 15:12:24 UTC
Tags:
auto generic clipper diamotrix loader golang stealer redline metastealer rust
Link:
https://app.any.run/tasks/a62bf65d-7d3d-41e7-bb56-ceb068448f03

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/18050/
Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688b59dd0b4775fb2133f260
Tags:
ransomware small hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Сreating synchronization primitives
Creating a process from a recently created file
Connection attempt
Sending an HTTP POST request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Labled as:
Trojan.Heur.Generic
Link:
https://www.hybrid-analysis.com/sample/1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a
Gathering data
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/6e8354adddf8bd54b877e2d1ea8bb0a8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a/
Verdict:
Malicious
Threat:
Trojan-Spy.Win32.TCP
Link:
https://tip.neiki.dev/file/1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a
Threat name:
Win32.Ransomware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2025-07-25 05:59:08 UTC
File Type:
PE (Exe)
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=do64yw2srgvg7wsgxsk57frapmbp3wx4co43bvbwkfx3zanb6bna._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/250731-n26dpatyay/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e7c2bafe-0e56-4006-a417-d6e167434815
Unpacked files
SH256 hash:
1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a
MD5 hash:
6e8354adddf8bd54b877e2d1ea8bb0a8
SHA1 hash:
4e0cbc4dd051073489d4b6a0b40c651c28dad648
Detections:
SUSP_XORed_Mozilla
Create hunting rule
Link:
https://www.unpac.me/results/28af30a5-9df4-455f-8bb0-df58d46bda28/
Parent samples :
ca4a37f67b34dc07ecda7e91fff39565fe7b0f3348a346010b00b5232d2def10
1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a
5179505092e078e8c1b9d8b7f7056d9e452a3e597404a688347cf1284ba61d48
4fec337926905f8320a256918ae630037045ccfee6032065e1f8645f458337cc
49fb48df919c224ec73579ccc56492b84e0b2c1ac9b2e1ed2d508c95cb95058d
3e5c3ca7b20c3e35115307d76acb8ca7724f30a009f883b2cd93a113040ef18b
1a3b31b13826aa5ecd6629afafa5d3e08f308617f0be75aab590d21cfdb7bc8f
252a6a233d0be08e382758c0049fab4566e45630adeb41d4890be33f615bd2a9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1bbdcc5b5289aa6fda46bc95df96207b02fddafc13b9b0d436516fbc81a1f05a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/18050/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetCommandLineW

Comments