MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7788888fd7848d1a7242ffe9ee59c95147d1427e69c099e08cffae2fa1c8835a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Expiro


Vendor detections: 19


Intelligence 19 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7788888fd7848d1a7242ffe9ee59c95147d1427e69c099e08cffae2fa1c8835a
SHA3-384 hash: 2c9629a27abfc8cc6af5b101ab117f6e22a7bcc7cb69cb038b04563ef40dbce2b475f83881db76b2eaf3cbc32f97ce11
SHA1 hash: cb4d7dad5a39f262ffffe1a835fad34aeec63d7c
MD5 hash: 78ba1ff15b8658b703fdbdc13764cc4b
humanhash: eighteen-arkansas-lion-fanta
File name:Equipment Proposal _25401584 01.10.25.exe
Download: download sample
Signature Expiro
Create hunting rule
File size:1'314'816 bytes
First seen:2025-10-09 16:34:41 UTC
Last seen:2025-11-06 10:10:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:fHAN4wOz68l+x6SiA07xpp9b6EtIkgl0g2XDpxK24BUdq5+NWKmZmFcc:fHAN4wOu8l+xFiASpp9+EmkglZ2XdxKk
Threatray 1'278 similar samples on MalwareBazaar
TLSH T1B05523421A19D642D56B1FB00E3BC07423B41D85A936D31FDAC93E9B78BFE7449342AB
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter JAMESWT_WT
Tags:exe Expiro mail-octopus-uae-com

Intelligence

File Origin
# of uploads :
3
# of downloads :
85
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ebf9450edc76eb96613dd5da55ae55c21e3dabc39e901f4aea8d4adad01991a1.zip
Verdict:
Malicious activity
Analysis date:
2025-10-08 13:55:34 UTC
Tags:
arch-exec m0yv darkcloud
Link:
https://app.any.run/tasks/f35c0c8d-e174-4a2b-9b25-b918dbcfdeb4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/31931/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e66d56277c2bd8bc5de539
Tags:
stration spawn shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Launching a process
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% directory
Modifying a system executable file
Launching a service
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Searching for synchronization primitives
Loading a system driver
Creating a file in the system32 subdirectories
Connection attempt to an infection source
Modifying an executable file
Modifying a system file
Creating a file in the Windows subdirectories
Enabling autorun for a service
Query of malicious DNS domain
Stealing user critical data
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Infecting executable files
Sending an HTTP POST request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
explorer lolbin obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/68e7f938d4a0085473c5d08e/reports/3603e51a-8667-42d4-8147-144bc30a1b97/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7788888fd7848d1a7242ffe9ee59c95147d1427e69c099e08cffae2fa1c8835a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-08T06:51:00Z UTC
Last seen:
2025-10-09T09:47:00Z UTC
Hits:
~1000
Detections:
Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb Virus.Win64.Moiva.a Virus.Win32.Moiva.a Trojan-PSW.Win32.Stelega.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.DarkCloud.sb Trojan.Kryplod.UDP.C&C VHO:Trojan.Win32.Sdum.gen Trojan.Agentb.UDP.ServerRequest PDM:Trojan.Win32.Generic HEUR:Virus.Win32.Generic HEUR:Trojan-PSW.MSIL.Agensla.gen HEUR:Trojan.Win64.Kryplod.pef
Link:
https://opentip.kaspersky.com/7788888fd7848d1a7242ffe9ee59c95147d1427e69c099e08cffae2fa1c8835a/results?tab=lookup
Malware family:
Expiro
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/72d94d8d-ca51-4b4b-b133-dafa4e2be045
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7788888fd7848d1a7242ffe9ee59c95147d1427e69c099e08cffae2fa1c8835a
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.39 Win 32 Exe x86
Link:
https://app.malva.re/file/78ba1ff15b8658b703fdbdc13764cc4b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7788888fd7848d1a7242ffe9ee59c95147d1427e69c099e08cffae2fa1c8835a/
Threat name:
ByteCode-MSIL.Trojan.XWorm
Create hunting rule
Status:
Malicious
First seen:
2025-10-08 10:31:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o6eird6xqsgru4sc77u64wojkfd5cqt6nhajtyem76xc7ioiqnna._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
0443e508c14630fca81d33c7a33555a32cc35226ebd95d10e361a22fa3beed2a
Expiro
0a1d5fc8da6db14afc66ac764bb4448bea7e2b49088805b6f013a5b2f44e3418
Expiro
767829ce973d5fc84ba89fc041e49b954e902ad63bac4ea28ced107ccb8182c5
Expiro
7a1ce8bd54ceec847363d5841cc5016d7fe8226d3ff07be023f42f7336ccd594
Expiro
7c37658b857d29e661fe66bfc5a66bdace06d5e0873d4285bb005cb993998033
Expiro
85ca361774e85369bc191c5b57736abcec4ba69512703979f0b5e217b213b333
Expiro
b7fc85c1e68221a10c9c9cc8c321f1a2cce8be9914cf5033a382d6634dbb0aa6
Expiro
bcd6cf9ae14f189191f56ddd643585681fd65271ff7f0c6a4ba9000a316d3001
Expiro
error
Expiro
+ 1'268 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery execution ransomware spyware stealer
Link:
https://tria.ge/reports/251009-wfjxkaspv4/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
DarkCloud
Darkcloud family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/50631af9-b56b-4a03-85dc-9adac521b270
Unpacked files
SH256 hash:
7788888fd7848d1a7242ffe9ee59c95147d1427e69c099e08cffae2fa1c8835a
MD5 hash:
78ba1ff15b8658b703fdbdc13764cc4b
SHA1 hash:
cb4d7dad5a39f262ffffe1a835fad34aeec63d7c
Link:
https://www.unpac.me/results/47e31538-80b6-44d9-b194-aa84f1ef1fd8/
SH256 hash:
f7ad4b09afb301ce46df695b22114331a57d52e6d4163ff74787bf68ccf44c78
MD5 hash:
a63dc5c2ea944e6657203e0c8edeaf61
SHA1 hash:
ace762c51db1908c858c898d7e0f9b36f788d2d9
Link:
https://www.unpac.me/results/47e31538-80b6-44d9-b194-aa84f1ef1fd8/
SH256 hash:
8687b923d3c38e9761414fc7944311908b19168ae25f7af17cd279a317eb6a35
MD5 hash:
3a997cccbbd6eb468bf29db83920fcf4
SHA1 hash:
22d445629aae77ccd3f3edc4bec3879120e0ce2f
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/47e31538-80b6-44d9-b194-aa84f1ef1fd8/
SH256 hash:
2eb0d76827f622d2280eb186bc19b2f46e2ac88292bc8e142dca9aa2ccad205f
MD5 hash:
7bfa9a684117e7fcbdb2d6ff97b1a1d0
SHA1 hash:
6e8ca84992cb3a71bf4038c012d1916425c6ae26
Detections:
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/47e31538-80b6-44d9-b194-aa84f1ef1fd8/
Parent samples :
1cd07076c21df938ca1bd5c2246808a2e9000817544bec342473c8fab53525c6
7788888fd7848d1a7242ffe9ee59c95147d1427e69c099e08cffae2fa1c8835a
d5ffca1430a7af94f3bbc02893f7494b0a2b3d3cdb90c013f1946f14a26556d7
93b9a10bd711714af0a4ae073340f33dd22235b6169bbc82672dd0eeca46070d
c1817acba85fd9712b55cee789940b06e3911a589350f8021a35ab50903b0092
b7e4109f5c69a0a60796626e91ce4dae79038d3e193eed55f2da46f5217f1318
d941bd32f32b2bf5991935df25840f6e3208be2dd4b99828a3eca260a2760563
6a2c55fbe2221388774d27da453bd8f52d55732edf1099daa831754d35a96eee
SH256 hash:
868f9844cd6f0ea25b1115f509044f21f71a787afe9b706eb44c11f4942cb563
MD5 hash:
55786c675054c44592975b5fa7f643fb
SHA1 hash:
851f36ec99a212528ee1d5070af0907aaa05c483
Link:
https://www.unpac.me/results/47e31538-80b6-44d9-b194-aa84f1ef1fd8/
SH256 hash:
abdd6f31a909b0b10e30ced74a1f6f037adf1f61a8a842048dbc254d6f076169
MD5 hash:
c33a7f0e25bb3f4d3c19fc8441e9d12b
SHA1 hash:
0286b277e97b9f7c217a0d029e8144f8e20b40b9
Link:
https://www.unpac.me/results/47e31538-80b6-44d9-b194-aa84f1ef1fd8/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7788888fd784/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7788888fd7848d1a7242ffe9ee59c95147d1427e69c099e08cffae2fa1c8835a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31931/

Comments