MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67bb8319e5c9335c925f42015839dce2e47cd688ef4934d61df5bfd5778de9cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Horabot


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67bb8319e5c9335c925f42015839dce2e47cd688ef4934d61df5bfd5778de9cc
SHA3-384 hash: 159fc0b8cc43f0767911163c4fe4139f93afa8e0327ebe10e6a2f5bcef344101bca7a44beca70e61a86fce90418f7a36
SHA1 hash: 7bb50ad58283bf6197f4bea0ba8d70271b5c1da0
MD5 hash: 319dc6da6e8578bd95d5eab612607447
humanhash: angel-speaker-mango-high
File name:m.zip
Download: download sample
Signature Horabot
Create hunting rule
File size:24'780'411 bytes
First seen:2024-03-17 14:12:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 393216:JlUP+q8jx5dU+40WiwImQXn8y7jcLiBDfT1rptYaq30F+QCNoNgXTAP6mWbbnMzi:/yGx5dUAWiwImQXn8yPnBjT11tYP3goZ
TLSH T1C54733A2CA89B68A7B357E09A87F902001FF1C07DD95C59CD896D79BFC08567CC8960F
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter 1ZRR4H
Tags:horabot zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
CL CL
File Archive Information

This file archive contains 11 file(s), sorted by their relevance:

File name:foi.txt
File size:285 bytes
SHA256 hash: 8720c22ed56fe233b759bbe8df16983952649d0ee725511c0d9c41230560f08a
MD5 hash: b30b573315f4594640e6f5f2817212a9
MIME type:text/plain
Signature Horabot
File name:WebView2Loader.txt
File size:108'448 bytes
SHA256 hash: 446b4d19ed8fa1563b77a7f36261b76911b208af1d00a805d54e44b01ca3f54a
MD5 hash: 61e6b94ab6109254fbef360681f5b80d
MIME type:application/x-dosexec
Signature Horabot
File name:6.txt
File size:11'117'064 bytes
SHA256 hash: e6e0f6fdf0ac969be027a2297ad10549a52a459dd4b8218930c7da1c321d0009
MD5 hash: 1db5e55b833e155184c8219f5ab66ae7
MIME type:application/octet-stream
Signature Horabot
File name:b.txt
File size:24'276 bytes
SHA256 hash: f766c1f32642d31e0af21d4739a2df9473b1bf2253715b4bf8cc78b42cb398f1
MD5 hash: cfd0d787a9b07cc63dcd47bde8135621
MIME type:application/octet-stream
Signature Horabot
File name:i7.txt
File size:15'936 bytes
SHA256 hash: 7cc34a5423bd3fc9fa63d20ebece4103e22e4360df5b9caa2b461069dac77f4d
MD5 hash: 4afcab972e98ecbf855f915b2739f508
MIME type:application/x-dosexec
Signature Horabot
File name:jli.txt
File size:31'313'645 bytes
SHA256 hash: 66351e0dc731acbc2e6f3d201de5088f4fffb4052896839906afef535eee1370
MD5 hash: 2dfe9ca2dc55c0eb0e9e8b603fad7c28
MIME type:application/x-dosexec
Signature Horabot
File name:c.txt
File size:24'260 bytes
SHA256 hash: ccbf98a3ad7da149398fb0f0052b83eed48ac431fb00bc509a6201246e4df137
MD5 hash: c67c9700d08a44707ac09fd39085cbba
MIME type:application/octet-stream
Signature Horabot
File name:at.txt
File size:4'033'032 bytes
SHA256 hash: 4928c062020ec178d293597c8cc360d4d4635fed3f478a1dff291eb68cb384ea
MD5 hash: 6ec0e533f9b4016bde3a97ad809fcfd4
MIME type:application/octet-stream
Signature Horabot
File name:MSVCR100.txt
File size:773'968 bytes
SHA256 hash: 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 hash: bf38660a9125935658cfa3e53fdc7d65
MIME type:application/x-dosexec
Signature Horabot
File name:as.txt
File size:341 bytes
SHA256 hash: b6a9f543814d11cc5cb4061d6a4ac0f262b104bd99636394a55525716e0790bc
MD5 hash: 716951949ed814c9bdabba8e7fd6f1ad
MIME type:text/plain
Signature Horabot
File name:exe.txt
File size:893'608 bytes
SHA256 hash: 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 hash: c56b5f0201a3b3de53e561fe76912bfd
MIME type:application/x-dosexec
Signature Horabot
Vendor Threat Intelligence
Verdict:
Unknown
Threat level:
n/a  -.1/10
Confidence:
100%
Tags:
lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65f6fa703f97ea2d1e3d82e9/reports/5b517e09-555c-41b2-a44d-eca8f54582f2/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/67bb8319e5c9335c925f42015839dce2e47cd688ef4934d61df5bfd5778de9cc
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/67bb8319e5c9335c925f42015839dce2e47cd688ef4934d61df5bfd5778de9cc
Score:
73%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/67bb8319e5c9335c925f42015839dce2e47cd688ef4934d61df5bfd5778de9cc
Gathering data
Threat name:
Win32.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2024-03-17 14:13:09 UTC
File Type:
Binary (Archive)
Extracted files:
162
AV detection:
15 of 38 (39.47%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m65yggpfzezvzes7iiavqoo44lshzvui55etjvq56w75k54n5hga._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240317-vt9vgaba95/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/67bb8319e5c9335c925f42015839dce2e47cd688ef4934d61df5bfd5778de9cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Script
Create hunting rule
Author:@bartblaze
Description:Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments