MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b8526752f7a9580fc6ee88c35c8df39ef69ba1ab4241bba1fad1fb44c80a7a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments

SHA256 hash:	7b8526752f7a9580fc6ee88c35c8df39ef69ba1ab4241bba1fad1fb44c80a7a5
SHA3-384 hash:	84509fc15eaa64895e8f5345507ac4852a362466107a19ad3028a8939948e1499a4f3231e9424dfd51d3d15071ea6cf7
SHA1 hash:	fce3cdcfc4067af2451d638e99bb1ede113c29b8
MD5 hash:	19861d67b2811d6eb3be1951b28703ae
humanhash:	victor-victor-blossom-sweet
File name:	random(7).exe
Download:	download sample
File size:	2'013'088 bytes
First seen:	2025-01-02 08:14:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ce92706925e359aa40f23197a9743843 (2 x RedLineStealer, 1 x Mimikatz)
ssdeep	24576:4U77L3RZgH96z4S/zCtTFL/LcfQnolkbe7yFH3HtDg8VG:4U77L3RZo6/EFPQQny77I3N3VG
TLSH	T112951256737D14F4D11B8038FAA15A5FD6B3B0918B23939B026193766F13BE0BD6B322
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.EXE) Win16/32 Executable Delphi generic (2072/23) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
File icon (PE):
dhash icon	cc33b2ccccb233cc
Reporter	JAMESWT_WT
Tags:	exe lev-tolstoi-com

Intelligence

File Origin

# of uploads :

# of downloads :

362

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

c17d20e6be092651357a8b466257b795.exe

Verdict:

Malicious activity

Analysis date:

2024-12-31 08:46:11 UTC

Tags:

lumma stealer loader themida stealc amadey botnet autoit auto generic github credentialflusher gcleaner cryptbot litehttp

Link:

https://app.any.run/tasks/dd438ff2-3fbe-42a3-b448-8e2045400eb5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.MulDrop28.57658.3342.4520.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67764b0f74a2bd296e251497

Tags:

autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Creating a process from a recently created file

Creating a file

Running batch commands

Creating a process with a hidden window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context fingerprint hook installer keylogger overlay packed packer_detected

Link:

https://www.filescan.io/uploads/67764b0b0a45a868c018714c/reports/cfaabc01-7d09-4030-a8dc-5cc9ea989add/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7b8526752f7a9580fc6ee88c35c8df39ef69ba1ab4241bba1fad1fb44c80a7a5

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/35a6a287-7325-4c8a-896e-a77700f2f9d8

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1583235

Signature

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Multi AV Scanner detection for submitted file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Behaviour

Behavior Graph:

Download SVG

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7b8526752f7a9580fc6ee88c35c8df39ef69ba1ab4241bba1fad1fb44c80a7a5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b8526752f7a9580fc6ee88c35c8df39ef69ba1ab4241bba1fad1fb44c80a7a5/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pocsm5jppkkyb7do5cgdlsg7hhxwtoq2wqsbxoq7vup3iteau6sq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/250102-j5kh6svqen/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/3402e12b-5745-49c7-bec1-fddd97474b27

Unpacked files

SH256 hash:

92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45

MD5 hash:

8fa52f316c393496f272357191db6deb

SHA1 hash:

b1ff3d48a3946ca7786a84e4a832617cd66fa3b9

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/f2432ca6-6680-461c-94ab-8c51b216a43f/

Parent samples :

92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
61e49a19884c9d3d22ea4516a24d2a15c77325f7c57da4c5cae232369281dc98
375b35499333d8cd0823f64a4624b4106fdd15839ad0439aeb02353cdab4ed61
7b8526752f7a9580fc6ee88c35c8df39ef69ba1ab4241bba1fad1fb44c80a7a5
d421cda5ce74477bcc1e0b7f02ad75a5ae7fd53811922e2113ebdba61719f973
c5ab1d48b2971f2b7f070a88d8e308f8e2b6bc2f143f74e15016ad52049e9223

SH256 hash:

21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

MD5 hash:

fdd04dbbcf321eee5f4dd67266f476b0

SHA1 hash:

65ffdfe2664a29a41fcf5039229ccecad5b825b9

Link:

https://www.unpac.me/results/f2432ca6-6680-461c-94ab-8c51b216a43f/

SH256 hash:

10f8f24aa678db8e38e6917748c52bbcd219161b9a07286d6f8093ab1d0318fa

MD5 hash:

126fb99e7037b6a56a14d701fd27178b

SHA1 hash:

0969f27c4a0d8270c34edb342510de4f388752cd

Link:

https://www.unpac.me/results/f2432ca6-6680-461c-94ab-8c51b216a43f/

SH256 hash:

7b8526752f7a9580fc6ee88c35c8df39ef69ba1ab4241bba1fad1fb44c80a7a5

MD5 hash:

19861d67b2811d6eb3be1951b28703ae

SHA1 hash:

fce3cdcfc4067af2451d638e99bb1ede113c29b8

Link:

https://www.unpac.me/results/f2432ca6-6680-461c-94ab-8c51b216a43f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7b8526752f7a9580fc6ee88c35c8df39ef69ba1ab4241bba1fad1fb44c80a7a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_david_CSC846 Create hunting rule
Author:	David
Description:	CSC-846 Golang

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	XWorm_3_0_3_1_Detection Create hunting rule
Author:	Archevod
Description:	Detects XWorm versions 3.0 and 3.1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 7b8526752f7a9580fc6ee88c35c8df39ef69ba1ab4241bba1fad1fb44c80a7a5

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3386176/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::FreeSid
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::CheckTokenMembership
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteW SHELL32.dll::ShellExecuteExW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetDriveTypeW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetDiskFreeSpaceExW KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AssignProcessToJobObject
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::GetSystemDirectoryW KERNEL32.dll::GetFileAttributesW KERNEL32.dll::FindFirstFileW
WIN_USER_API	Performs GUI Actions	USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample