🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7162bf93a6587a6899c92d36e8d393d0654f3bf591b4fa595def6ab5d0f2ae5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7162bf93a6587a6899c92d36e8d393d0654f3bf591b4fa595def6ab5d0f2ae5c
SHA3-384 hash: a007ee565ed99c399a75b85b10ba7bafcfb5536c8678ebd9a23e49a583e2bbe18bfb2926741322e28b763c9c96745808
SHA1 hash: 7cc95ad7c645c377fb31cae1504799d79ed43f46
MD5 hash: b1f942ed2b04b68e7581ccf0b0cd0ac7
humanhash: stairway-diet-illinois-rugby
File name:Project requirements.img
Download: download sample
File size:18'022'400 bytes
First seen:2023-01-19 16:45:03 UTC
Last seen:Never
File type: img
MIME type:application/octet-stream
ssdeep 393216:3tRi5PsY+y1CPwDv3uFhLU2lvzg+7QJfYqEi:3odYqE
TLSH T16F07AD26B25400D5D8B78039C163562BDBB2BD69172093DF21A5B2A81F337D32BBF716
TrID 99.3% (.NULL) null bytes (2048000/1)
0.3% (.GL) GRASP animation (6508/7/3)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter k3dg3___
Tags:Cobalt Strike img lnk pw-JAN1923 Python TA580

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
US US
File Archive Information

This file archive contains 36 file(s), sorted by their relevance:

File name:vcruntime140_1.dll
File size:38'304 bytes
SHA256 hash: 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
MD5 hash: 75e78e4bf561031d39f86143753400ff
MIME type:application/x-dosexec
File name:_socket.pyd
File size:77'688 bytes
SHA256 hash: 71f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
MD5 hash: 4ceb5b09b8e7dc208c45c6ac11f13335
MIME type:application/x-dosexec
File name:_asyncio.pyd
File size:64'384 bytes
SHA256 hash: 97ed94f8d35445573177ba75e17dcf4c667e3c236c0b4d436fa97f8c862cc0bd
MD5 hash: 4ab3a456c59f6aed0d147c31fab59604
MIME type:application/x-dosexec
File name:libcrypto-1_1.dll
File size:3'441'504 bytes
SHA256 hash: 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
MD5 hash: 6f4b8eb45a965372156086201207c81f
MIME type:application/x-dosexec
File name:_ctypes.pyd
File size:123'264 bytes
SHA256 hash: 7adcea3a5568752a6050610cfbe791a4f8186aaaa002f916b88560a1ddab580f
MD5 hash: 2abeebe2166921a4d8b67b8f8a2b878a
MIME type:application/x-dosexec
File name:python310.dll
File size:4'492'160 bytes
SHA256 hash: c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
MD5 hash: 54f8267c6c116d7240f8e8cd3b241cd9
MIME type:application/x-dosexec
File name:pythonw.exe
File size:100'216 bytes
SHA256 hash: 61957119137f9492ab7cff41ed83619cdd398b8d47ceb4feeba5ed9bd0fcdc22
MD5 hash: 535dbfade17a856935667eae25acc166
MIME type:application/x-dosexec
File name:_queue.pyd
File size:30'584 bytes
SHA256 hash: 24c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a
MD5 hash: 8eabd51d536276f3b3257ee975e50bfc
MIME type:application/x-dosexec
File name:_uuid.pyd
File size:23'936 bytes
SHA256 hash: e650244ff050dffadd9eb2b4462ec1f28bc2c9d6e090e05b2e8b0d9451712ff3
MD5 hash: e061dc788fd6d81e08cec63f08ee882b
MIME type:application/x-dosexec
File name:_decimal.pyd
File size:248'696 bytes
SHA256 hash: 2bab2833c24eb4e07fe082d291013eed000a5cfc22df49311c729e7a57fe632e
MD5 hash: b6acb44c2f580991df7b1358a0fc0b69
MIME type:application/x-dosexec
File name:_elementtree.pyd
File size:127'872 bytes
SHA256 hash: 0f35db36f3768bd096727c731aa76879650246d550c503af381cd96adee35258
MD5 hash: 23844dc840c287df4fdf3adf76a751f1
MIME type:application/x-dosexec
File name:_hashlib.pyd
File size:61'816 bytes
SHA256 hash: 23063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
MD5 hash: 477dd76dbb15bad8d77b978ea336f014
MIME type:application/x-dosexec
File name:python3.dll
File size:64'896 bytes
SHA256 hash: abb50921ef463263acd7e9be19862089045074ea332421d82e765c5f2163e78a
MD5 hash: e0ca371cb1e69e13909bfbd2a7afc60e
MIME type:application/x-dosexec
File name:_multiprocessing.pyd
File size:33'144 bytes
SHA256 hash: b28e94b921d5d539cbd5f97ff4926e4f186791af1b364de7be7fcce3970172f7
MD5 hash: d9f27a0d595c8b044f78e7bb25fd107a
MIME type:application/x-dosexec
File name:Requirements.lnk
File size:1'310 bytes
SHA256 hash: 6e37e051433faa97a381fc8d8a51e8d0a5384d2fc7abc3dcf727d036bc196a74
MD5 hash: 2157d05171e0a32c30a8c8350d25335a
MIME type:application/octet-stream
File name:pyexpat.pyd
File size:198'528 bytes
SHA256 hash: 30eb08571a88165b84bc0783c3ffbf19e9d99c5634ab274c73a8ddca163cafda
MD5 hash: 2aa10c44252c9d241a01557700df12af
MIME type:application/x-dosexec
File name:_bz2.pyd
File size:83'320 bytes
SHA256 hash: 190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
MD5 hash: 23dce6cd4be213f8374bf52e67a15c91
MIME type:application/x-dosexec
File name:vcruntime140.dll
File size:98'736 bytes
SHA256 hash: d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 hash: f12681a472b9dd04a812e16096514974
MIME type:application/x-dosexec
File name:_overlapped.pyd
File size:48'504 bytes
SHA256 hash: 370b4ad06881c3cb781be0f78476eaeb5e440c60498f5791c3d413860fdc9b5e
MD5 hash: 04f8440ff4724eb61a35ac13f3643ae9
MIME type:application/x-dosexec
File name:_zoneinfo.pyd
File size:43'392 bytes
SHA256 hash: 4333fc3595ea1ea48c5a983f8b60a64c192f39e5a0be2c7acd0033467269556d
MD5 hash: e4c4a639cfb3d082b2fdb44ce08c1be3
MIME type:application/x-dosexec
File name:python.exe
File size:101'760 bytes
SHA256 hash: 3093fcf263029ca1d799fea250a4e032d2c930a516f1513eeca688b343c836b3
MD5 hash: 0d7e35d7b045ec9447aa18d064fcd9c8
MIME type:application/x-dosexec
File name:_ssl.pyd
File size:159'096 bytes
SHA256 hash: 4e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
MD5 hash: dcb25c920292192dd89821526c09a806
MIME type:application/x-dosexec
File name:sqlite3.dll
File size:1'445'752 bytes
SHA256 hash: a24d35883540182d7304ffb9c8342abe53ed8da53455e57721c7ae452280b093
MD5 hash: f2220d34a76303b0c4c115b529153968
MIME type:application/x-dosexec
File name:select.pyd
File size:29'056 bytes
SHA256 hash: 8b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
MD5 hash: a7863648b3839bfe2d5f7c450b108545
MIME type:application/x-dosexec
File name:winsound.pyd
File size:29'560 bytes
SHA256 hash: 78e466bebe3b2718234d0e021931d8916fcbcf4666c8e65c4fee62c234c12435
MD5 hash: e8060795d8dc9eb8264652de8b2656fa
MIME type:application/x-dosexec
File name:libffi-7.dll
File size:32'792 bytes
SHA256 hash: f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 hash: eef7981412be8ea459064d3090f4b3aa
MIME type:application/x-dosexec
File name:_msi.pyd
File size:43'392 bytes
SHA256 hash: 4fe82284a550f67ed844a2ba052c63916d6c6c17b70c4d5e2fd7f6c4ac8a579f
MD5 hash: ac20e4b6d498b445008ded2095964d5e
MIME type:application/x-dosexec
File name:libssl-1_1.dll
File size:702'816 bytes
SHA256 hash: 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
MD5 hash: 8769adafca3a6fc6ef26f01fd31afa84
MIME type:application/x-dosexec
File name:python.cat
File size:601'118 bytes
SHA256 hash: 0e6d32525691f028ab888157c99a1419eb67e98a5e79c9b2a1cd2918ab7ff626
MD5 hash: 92016e529f41c0157964f948e2a1bdf3
MIME type:application/octet-stream
File name:unicodedata.pyd
File size:1'121'152 bytes
SHA256 hash: a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
MD5 hash: cf1eda3f804dfa64ac00cad29ab243e1
MIME type:application/x-dosexec
File name:_sqlite3.pyd
File size:97'656 bytes
SHA256 hash: 54c5c66e26bcdb9badde9c241104d59ebf57420d9cfcf72ab1737fa1a8f87bce
MD5 hash: 3250302acbe9f7cbababf13ea87a4af7
MIME type:application/x-dosexec
File name:_lzma.pyd
File size:158'072 bytes
SHA256 hash: 5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
MD5 hash: 401eca12e2beb9c2fbf4a0d871c1c500
MIME type:application/x-dosexec
File name:python310.zip
File size:2'640'871 bytes
SHA256 hash: 1fc143399b184ff1c26246da037d1d20f99b166922cd3ac16ed299b99b80e4de
MD5 hash: e5161749e8fe4fc83b5d47006fcac9a3
MIME type:application/zip
File name:projectt.py
File size:551 bytes
SHA256 hash: d712f823065d710535392c8c80b6c874da06f68b707c7e18306344eb99c5847c
MD5 hash: bd4dab365285c2c3557af8335632b5af
MIME type:text/plain
File name:python310._pth
File size:80 bytes
SHA256 hash: e9ae01c8efc72ff96484d7f54ae47805a16c0eb842721e6f03e677f356e781e9
MD5 hash: 0c2d1a15406e669769ac3e7808a815df
MIME type:text/x-objective-c
File name:LICENSE.txt
File size:32'762 bytes
SHA256 hash: 792fd2d8227bb8785d144c40359b38d752842754e458102ba436fd46252763f3
MD5 hash: c210c85e8d48fbf83c461d0ee3e5b122
MIME type:text/plain
Vendor Threat Intelligence

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:ISO_exec
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in ISO files, seen in malware such as Bumblebee.
Rule name:LNK_sospechosos
Create hunting rule
Author:Germán Fernández
Description:Detecta archivos .lnk sospechosos
Rule name:Mimikatz_Generic
Create hunting rule
Author:Still
Description:attempts to match all variants of Mimikatz
Rule name:SUSP_LNK_CMD
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to cmd.exe inside an lnk file, which is suspicious

File information

The table below shows additional information about this malware sample such as delivery method and external references.

img 7162bf93a6587a6899c92d36e8d393d0654f3bf591b4fa595def6ab5d0f2ae5c

(this sample)

Shortcut (lnk) lnk 6e37e051433faa97a381fc8d8a51e8d0a5384d2fc7abc3dcf727d036bc196a74

  
Link
https://twitter.com/k3dg3/status/1616113852923486208
  
Dropping
SHA256 6e37e051433faa97a381fc8d8a51e8d0a5384d2fc7abc3dcf727d036bc196a74
  
Delivery method
Distributed via e-mail link

Comments