MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b
SHA3-384 hash: be50bd633f9400c5d9a68bbde56648fb69109c05069cf51587c0d5e849dbc3039bf939c575b9d2d9a8e9d2a6c7c322ab
SHA1 hash: 0d8230a3ac6bd4ef155aefc482ac0ff8d31b65ad
MD5 hash: a25f37807d19caeb9c23267534876d75
humanhash: purple-burger-autumn-neptune
File name:SecuriteInfo.com.Trojan.PackedNET.3323.21128.29853
Download: download sample
File size:772'608 bytes
First seen:2025-06-27 00:25:18 UTC
Last seen:2025-07-07 15:14:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:r8tJp3Z2vh5YCw2bXwkkIUjGk4uGqR/witIvfAUvBAi/IHVonU:AtJp3Z2vh5YAvkrGk4yxLt6oeArV1
Threatray 3'900 similar samples on MalwareBazaar
TLSH T132F4025639ABC083C1A63FB484A3D3B84A347FE51872CAD7BBE93D4F7975A015112722
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 1a71c0aaaaaa0203 (10 x Formbook, 2 x RemcosRAT, 2 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
490
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rl_1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b
Verdict:
No threats detected
Analysis date:
2025-06-27 00:27:08 UTC
Tags:
netreactor
Link:
https://app.any.run/tasks/e44a41db-f3fc-4fe1-9b32-3a2b2eaf48dd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11288/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3323.21128.29853.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685de53ab06783b9ebd88145
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/685de516d1f1eb5d81c7c789/reports/4c42d3ed-dcbb-4578-8f4d-ecb69040f26f/overview
Verdict:
Malicious
Labled as:
MSIL/GenKryptik_AGeneric.BGJ trojan
Link:
https://www.hybrid-analysis.com/sample/1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d73b266f-8c4e-4911-a375-5a475ab82fb9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/a25f37807d19caeb9c23267534876d75
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2025-06-26 23:28:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpeejdsumnw7oc3feun3qbegoyubyr6uawxqgae3paufv4geiz5q._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Similar samples:
1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b
628b18c3acdc6e3ca86501324b908a2086a3e31167a81e9c912dedbcbd010147
649facade465ad92983e7f91f592eed9b04bd84bb4d2d78fcee013dd004f8758
71061c247762961b52c05043f9aad7acd24d6be55da97b79136685dc8d71fbcc
7e545a76c16dee6d24d3e86c6667c07bcd0f76064f232463b58fd4ec6d930090
error
f10dcedfa178a0bce77e909b072ff0deb66ab588db90b7f5eb3d0bbe8c75215b
+ 3'890 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/250627-aq769afj51/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9f23ed0b-2b0c-430f-91ed-15ea135b9129
Unpacked files
SH256 hash:
1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b
MD5 hash:
a25f37807d19caeb9c23267534876d75
SHA1 hash:
0d8230a3ac6bd4ef155aefc482ac0ff8d31b65ad
Link:
https://www.unpac.me/results/bb8f091a-7840-4d5f-97ba-06a82ceecc78/
SH256 hash:
ec2ea28b8c0d4ad5cde730c19b0d44ce7b77fc2ed732de4851f3a0db8cc8cd5f
MD5 hash:
a4985cd0f8a77893eba969664cb71f9d
SHA1 hash:
2e58b62c17fc5c9bd2c55e17a454f93aef0beb08
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/bb8f091a-7840-4d5f-97ba-06a82ceecc78/
SH256 hash:
a5c0006918a2d8df2f655b5dce6edee5c8ac336010fad6fe0d8cb17be6aecc1c
MD5 hash:
c93f82cd577fe45d220533947f0785cd
SHA1 hash:
3dbad7da0b630e878fb83b0706eba6ed0779e48c
Link:
https://www.unpac.me/results/bb8f091a-7840-4d5f-97ba-06a82ceecc78/
SH256 hash:
a004a734d8e9207fe5c5f9dd0e012954d6d514103d515de8aea38648e1db6350
MD5 hash:
4aa96f1eb805d96288c3aeda3721d116
SHA1 hash:
9c6f2866c5b64e92c2605d5d39b67f2e39f94a18
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/bb8f091a-7840-4d5f-97ba-06a82ceecc78/
Parent samples :
1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b
de9eeab3b5c6013da6e46431f20f865c15086d8708fb81a9da1e0de2629b8280
SH256 hash:
79705f88ad9690834eac1dcd5f6f432dea6f0f7355a68a1f708f64b94698ec13
MD5 hash:
52772b0b5651135e0fba3490abc5f60f
SHA1 hash:
404c4bf3981b604fdd67b4c35c4ff1d37a0d122c
Link:
https://www.unpac.me/results/bb8f091a-7840-4d5f-97ba-06a82ceecc78/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1bc8448e5463/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/1bc8448e54636df70b65251bb8048676281c47d405af03009b78285af0c4467b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/11288/

Comments