MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cd404d186d756181584b2223e3fbdae156d968fccedcf32e3440822d148254f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cd404d186d756181584b2223e3fbdae156d968fccedcf32e3440822d148254f
SHA3-384 hash: 215671a7a91919da4d972cfd15746a10825f7baa9ae51fe27393f73a55e8a89c2a76bede7c39439bf7cdc03088d87e55
SHA1 hash: 18fb5658a662e3840ede0a23031f4eea991cd079
MD5 hash: d771c401c91e2ed70e2c8e3916102425
humanhash: alanine-beer-rugby-low
File name:ratgshfdjtc_sfx.exe
Download: download sample
File size:4'065'166 bytes
First seen:2025-06-02 08:01:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 98304:O5yYhsz6uFKtgx5qpyoHvS5zAjk/FNmViC8E2Nu3:OrLGZkS5zh/FN3zlG
TLSH T1B3163351FAD588B2E83118325D2572A1A87DB9216C24DE7B73D84E3BC6705C1E332BB7
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10522/11/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon e88e1a692d0f0d96
Reporter FXOLabs
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
422
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ratgshfdjtc_sfx.exe
Verdict:
No threats detected
Analysis date:
2025-06-02 08:42:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/63d6f2cf-b3bd-4434-a027-70e6b5cae044

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/6848/
Detection(s):
SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=683d5bfeacf88f5815eb1e8d
Tags:
injection obfusc virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint installer microsoft_visual_cc overlay overlay packed packer_detected sfx
Link:
https://www.filescan.io/uploads/683d5a562d1d8b12425e38e4/reports/71485898-6f19-452d-ab04-2bbd867cc812/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1cd404d186d756181584b2223e3fbdae156d968fccedcf32e3440822d148254f
Gathering data
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
36 / 100
Link:
https://www.joesandbox.com/analysis/1703810
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1cd404d186d756181584b2223e3fbdae156d968fccedcf32e3440822d148254f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cd404d186d756181584b2223e3fbdae156d968fccedcf32e3440822d148254f/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-06-02 05:52:58 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dtkajumg25lbqfmewird4p55vykw3fupztw46mxdiqecfukievhq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250602-jw9rpsxxaz/
Behaviour
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7ebefd32-4160-4fe1-9777-2d6554965107
Unpacked files
SH256 hash:
1cd404d186d756181584b2223e3fbdae156d968fccedcf32e3440822d148254f
MD5 hash:
d771c401c91e2ed70e2c8e3916102425
SHA1 hash:
18fb5658a662e3840ede0a23031f4eea991cd079
Link:
https://www.unpac.me/results/d4232644-3ec0-4b3b-9a98-637118048895/
SH256 hash:
21c39e712fd31695f80c4a4679815a6169471fbe6633cdef158c5f228a7697c6
MD5 hash:
99cc2dcfe240fa1b209d0058d92ae099
SHA1 hash:
3147b7ddab6651acc7218f419cdd718084e00b6f
Link:
https://www.unpac.me/results/d4232644-3ec0-4b3b-9a98-637118048895/
SH256 hash:
86275f575355c59187e593eb4b4b24ab79953a52b51ce1be53483c6430d175a2
MD5 hash:
34a0f9c09d72d1f424d9243ebd2ab670
SHA1 hash:
63898c0d5edcea09d2ddd88086a02ede3c242671
Link:
https://www.unpac.me/results/d4232644-3ec0-4b3b-9a98-637118048895/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1cd404d186d756181584b2223e3fbdae156d968fccedcf32e3440822d148254f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dcrat_
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked dcrat malware samples.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Executable exe 1cd404d186d756181584b2223e3fbdae156d968fccedcf32e3440822d148254f

(this sample)

  
Delivery method
Distributed via e-mail attachment
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/6848/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipAlloc
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::AttachConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW

Comments