MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fd30cbd849b5026b3b33c62c34df1aa570e7dd12e1d88f2eb27d7d57fae47ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 5 File information Comments

SHA256 hash:	3fd30cbd849b5026b3b33c62c34df1aa570e7dd12e1d88f2eb27d7d57fae47ac
SHA3-384 hash:	4909b65f3b054ecd5e77a913a1744deedd8efc550e46463ac3faf78b350d3b3df2f98e945d769f72b110dae9d512ba1d
SHA1 hash:	bf0b15ad7d00573deb98f6882cd3966943b55cd7
MD5 hash:	e45edb073040fc2916cc6ec4b2a95e18
humanhash:	don-minnesota-romeo-white
File name:	shrk.bin
Download:	download sample
File size:	17'575'354 bytes
First seen:	2025-07-20 15:22:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	40ab50289f7ef5fae60801f88d4541fc (59 x ValleyRAT, 49 x Gh0stRAT, 41 x OffLoader)
ssdeep	196608:5rdZzAXpFqm8EZT1SoAU92xLi0rX+2S+rOJq+Yik8CmA3z0cWpwCfVGfpOuDpIN3:5pkqm8AHAg4NrXdKTYhtz0cWKCfUO
TLSH	T12C072322B2CB9C3EE45A0B361D72AE7454FB66636426ADF297F084BCCE315501D2D633
TrID	62.3% (.EXE) Inno Setup installer (107240/4/30) 24.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 6.1% (.EXE) Win64 Executable (generic) (10522/11/4) 2.6% (.EXE) Win32 Executable (generic) (4504/4/1) 1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
dhash icon	f0967169697196f0 (1 x SharkStealer)
Reporter	abuse_ch
Tags:	bin exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

shrk.bin

Verdict:

Malicious activity

Analysis date:

2025-07-20 15:34:44 UTC

Tags:

inno installer delphi auto-reg auto generic arch-scr

Link:

https://app.any.run/tasks/1b2fe6aa-b67e-4168-9a26-b56028bcb81d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/15944/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=687d09d22f623871a5f0a43d

Tags:

rozena virus shell blic

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Running batch commands

Creating a process with a hidden window

Launching a process

DNS request

Connection attempt

Sending a custom TCP request

Setting a single autorun event

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/3fd30cbd849b5026b3b33c62c34df1aa570e7dd12e1d88f2eb27d7d57fae47ac

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/5ebaba07-4afe-484c-99b1-7b77f1c88194

Score:

78%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3fd30cbd849b5026b3b33c62c34df1aa570e7dd12e1d88f2eb27d7d57fae47ac

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/e45edb073040fc2916cc6ec4b2a95e18

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3fd30cbd849b5026b3b33c62c34df1aa570e7dd12e1d88f2eb27d7d57fae47ac/

Threat name:

Win32.Trojan.Kepavll

Status:

Malicious

First seen:

2025-07-19 23:49:19 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h7jqzpmetnicnm5thrrmgtprvjlq47orfyoyr4xle7l5k75oi6wa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery persistence spyware trojan

Link:

https://tria.ge/reports/250720-sr6c6aeq2w/

Behaviour

Modifies registry key

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Adds Run key to start application

Executes dropped EXE

Verdict:

Malicious

Tags:

TA_Abused_Service

YARA:

n/a

Link:

https://app.threat.zone/submission/3b401ab8-4355-4b33-8729-e520eeafca6c

Unpacked files

SH256 hash:

3fd30cbd849b5026b3b33c62c34df1aa570e7dd12e1d88f2eb27d7d57fae47ac

MD5 hash:

e45edb073040fc2916cc6ec4b2a95e18

SHA1 hash:

bf0b15ad7d00573deb98f6882cd3966943b55cd7

Link:

https://www.unpac.me/results/0de5cb4e-3a50-441f-ace2-874dfb60f461/

SH256 hash:

3295136ae75924ae83d407f19366b17bf263b09c8ea8ce8ce0e8979549d632d1

MD5 hash:

c45d7cee83fe408091585ad9b8bc3db6

SHA1 hash:

75e9bdf54fd5c26e5d788537c1c39490bd04dcc0

Link:

https://www.unpac.me/results/0de5cb4e-3a50-441f-ace2-874dfb60f461/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3fd30cbd849b5026b3b33c62c34df1aa570e7dd12e1d88f2eb27d7d57fae47ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 3fd30cbd849b5026b3b33c62c34df1aa570e7dd12e1d88f2eb27d7d57fae47ac

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3581740/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3583769/

Cape

https://www.capesandbox.com/analysis/15944/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	advapi32.dll::AllocateAndInitializeSid advapi32.dll::ConvertSidToStringSidW advapi32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW advapi32.dll::EqualSid advapi32.dll::FreeSid
SECURITY_BASE_API	Uses Security Base API	advapi32.dll::AdjustTokenPrivileges advapi32.dll::GetTokenInformation
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CreateProcessW advapi32.dll::OpenProcessToken advapi32.dll::OpenThreadToken kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA kernel32.dll::LoadLibraryExW kernel32.dll::LoadLibraryW kernel32.dll::GetDriveTypeW kernel32.dll::GetVolumeInformationW kernel32.dll::GetSystemInfo
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateDirectoryW kernel32.dll::CreateFileW kernel32.dll::DeleteFileW kernel32.dll::GetWindowsDirectoryW kernel32.dll::GetSystemDirectoryW kernel32.dll::GetFileAttributesW
WIN_BASE_USER_API	Retrieves Account Information	advapi32.dll::LookupPrivilegeValueW
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExW advapi32.dll::RegQueryValueExW
WIN_USER_API	Performs GUI Actions	user32.dll::PeekMessageW user32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample