MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69715fbd58afc0f39fe10b0672b80ffbd4fa4752b85eb2a7b016ffc758e5e9c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


YellowCockatoo


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69715fbd58afc0f39fe10b0672b80ffbd4fa4752b85eb2a7b016ffc758e5e9c6
SHA3-384 hash: 04908a9b3ec059b64a4d6799a9d95d4a1d976888a86788ce72f0c42c688524e1a5799802e01a02e474cf5e04c98f7d1a
SHA1 hash: dbfbf1af74493c8283aeb9a36973fb30d5750325
MD5 hash: b9ae234ebfa36f591b3c1da16474db2b
humanhash: emma-fourteen-six-aspen
File name:PABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZhXMYfNaBrM.dll
Download: download sample
Signature YellowCockatoo
Create hunting rule
File size:3'659'776 bytes
First seen:2023-11-22 21:22:35 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 98304:n1zLjxIlfhtrw6C80I31RjtXuFdHTNh2d5Uz9EU:nk1htrw6C80I31RjtXuFdHTNh2d5Uz9v
Threatray 1 similar samples on MalwareBazaar
TLSH T1490631023E49F791C1C96E7B42DEDE3943A0D4E349736787BF04BE681850266AE3527E
TrID 35.4% (.EXE) Win64 Executable (generic) (10523/12/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4505/5/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SquiblydooBlog
Tags:dll Jupyter Polazert solarmarker YellowCockatoo

Intelligence

File Origin
# of uploads :
1
# of downloads :
357
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/459765/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/655e71388bf76657029e09d2/reports/68e0f77c-dd56-45c9-b73e-2c09a86203a2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/69715fbd58afc0f39fe10b0672b80ffbd4fa4752b85eb2a7b016ffc758e5e9c6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b9dfd8c0-1e44-4bf8-853f-9143fab0c03f
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/1346616
Behaviour
Behavior Graph:
n/a
Score:
7%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/69715fbd58afc0f39fe10b0672b80ffbd4fa4752b85eb2a7b016ffc758e5e9c6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69715fbd58afc0f39fe10b0672b80ffbd4fa4752b85eb2a7b016ffc758e5e9c6/
Threat name:
Win32.Trojan.ScarletFlash
Create hunting rule
Status:
Malicious
First seen:
2023-11-22 16:32:52 UTC
File Type:
PE (.Net Dll)
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nfyv7pkyv7aphh7bbmdhfoap7pkpur2sxbplfj5qc374owhf5hda._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
69715fbd58afc0f39fe10b0672b80ffbd4fa4752b85eb2a7b016ffc758e5e9c6
YellowCockatoo
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231122-z8fmdsfd6t/
Unpacked files
SH256 hash:
69715fbd58afc0f39fe10b0672b80ffbd4fa4752b85eb2a7b016ffc758e5e9c6
MD5 hash:
b9ae234ebfa36f591b3c1da16474db2b
SHA1 hash:
dbfbf1af74493c8283aeb9a36973fb30d5750325
Link:
https://www.unpac.me/results/c112007a-e0e9-4844-bf49-ae1235efb2d9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/69715fbd58afc0f39fe10b0672b80ffbd4fa4752b85eb2a7b016ffc758e5e9c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/459765/

Comments