MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 27 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a
SHA3-384 hash: c1fb80d7bef5c2de08e5aeb97ac8bd27009ef0e0539bba93f4e304673651ed93ec2f3a5dc51946f48018e2b6c6fd9761
SHA1 hash: 7a228610a539de18de12ad8fcc7547cc7f8d2bd8
MD5 hash: 98b912dfd29aa642575542164e449dc5
humanhash: whiskey-helium-north-carpet
File name:svc.exe
Download: download sample
File size:15'082'489 bytes
First seen:2026-07-26 12:28:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 70d2e884fa127843c5bcbb53da86b6c8 (9 x TrustConnect, 3 x SoftConnect, 3 x AxisControl)
ssdeep 196608:cdvIyQs3CY9eO8OwcPFGUej4IegnBtg39dd+LyQ:cdrz7whr8IJBtg3o
TLSH T1F4E6AD02F3F842A9E5BFC278C5625517DBB2784A1720DBDF159485A92F33BD09E39322
TrID 22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win64 Executable (generic) (6522/11/2)
17.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.7% (.EXE) Win32 Executable (generic) (4504/4/1)
7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter BlinkzSec

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
GB GB
Vendor Threat Intelligence
Malware configuration found for:
ReadyToRun
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f33fa980-9a72-4760-b104-30ec8cc95460/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76256/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Launching a process
Creating a service
Launching a service
Creating a process from a recently created file
Searching for synchronization primitives
Сreating synchronization primitives
Connecting to a non-recommended domain
Sending an HTTP GET request
Enabling autorun for a service
Adding an exclusion to Microsoft Defender
Verdict:
Suspicious
Labled as:
Trojan/Generic
Link:
https://www.hybrid-analysis.com/sample/7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-08T19:16:00Z UTC
Last seen:
2026-07-28T03:22:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/542406f6-7978-4175-9b46-17adf324c2da
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Html Javascript in Html PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/98b912dfd29aa642575542164e449dc5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a/
Threat name:
Win64.Backdoor.Zegost
Create hunting rule
Status:
Suspicious
First seen:
2026-07-09 20:28:00 UTC
File Type:
PE+ (Exe)
Extracted files:
91
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=psvhdv5vvo7chj5njyddrpfdhhmubz4i277zrwgdx5sjbvfhymna._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution persistence
Link:
https://tria.ge/reports/260726-pnk19svcpg/
Behaviour
Checks processor information in registry
Detects videocard installed
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Launches sc.exe
Looks up external IP address via web service
Checks computer location settings
Creates new service(s)
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a
MD5 hash:
98b912dfd29aa642575542164e449dc5
SHA1 hash:
7a228610a539de18de12ad8fcc7547cc7f8d2bd8
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
88dd1dde64c18d8171938d6ae7343d9eb096e11a3c8fea89977230b4ede3f53b
MD5 hash:
58a782261469d3d58df94c7651d50030
SHA1 hash:
54110aa57cd48ed6987b8352fb78d100e95cd4bb
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
48bbd9cc4aa42eed75aebc5b585d5c0b315de6080addeb4693a4f2187267af99
MD5 hash:
dff4444ed4369aed4259c3e160874dd3
SHA1 hash:
9d64026cd4d69cffb06a8f978cf571854764ef9a
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
82f1e8503b805e2cd41d605305455eb87e33438c6605590aec1f24460b6f1bff
MD5 hash:
3bf15008dfbbdb551997f4df472932a5
SHA1 hash:
05924a9d3838e88ac43404ba70aeeb94086e1af2
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
c961b2a63186239ec21468459a9e4f4e69fad4ba2b67b4e39e04a17f73d81f1b
MD5 hash:
dc073efd167431bbb2eac4b735344bdb
SHA1 hash:
ffe26a5c80469cd40249f33c8ea29e5148c12498
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
a577a60d7e2a0dbcba1fd71250cbb5e400e116fe20ddd816f197bdc777527a2b
MD5 hash:
768bafb6dcb4c122d6b9d9b3495da856
SHA1 hash:
2f715492c000746cdbc6f6fa726f89356ec0689c
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
8049f40b395810593c23ca9f1ae8d605a55a6a34132c185b64755f4c0426d6b3
MD5 hash:
7bb641937f901c42ba75d98b13b3c43f
SHA1 hash:
a567eaeb2bc08571ff9b020318ad5c34c1deb78c
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
cae600fe662cee9f5b43189f136b187e3ea45949e3678a836394bd5a4555cab1
MD5 hash:
a632a6be6f46cf160103f6aad84d0f7b
SHA1 hash:
90035b653e5b313ecc159dce9ff4e2f7f387bab2
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
Parent samples :
38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0
2ffaa635caf56eba07b1049bab35e1eff7211c35b38a40f71029581b266924b4
SH256 hash:
8b94e250bc25fa79f5af7ddb6721fa9b75f931f4041e6d21dfcef9bf4a68e249
MD5 hash:
4b18783f50235f29d3883304cdfbe0bc
SHA1 hash:
78c8ca3b3e6c4c4adeaac43cab59f33f8aabe326
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
12435f9be78787eabb831f7c6127f80e6c843a2b4e968eff9aade9d58b24f9f8
MD5 hash:
9f78ed9d150cf9cefe796710bc913f9c
SHA1 hash:
e3d2fadee0d310964cc8df5fc7f07a80989001e0
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
0b6f69f8a1cf4d1581446a8914c08abfc1bef59c2b526fe1ab376858859423d3
MD5 hash:
e8c2b26574cff1eb80af2e6afec9fbfa
SHA1 hash:
02445e8c0498cc6940246b976a8092eb78fbc1f3
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
5cbf8b983a7f58c924fa800b9e815a0774584daea27fd0840705b90f8176d0e0
MD5 hash:
864d4133a8ea4c0f0a88ddc2c20fee2a
SHA1 hash:
b043d52533cb81d2f999e56ca3a4d123b23525d5
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
7f20af3ff69cf3936cade04b24afb18e3d1b9bec9e6c0064fac21a85d57424db
MD5 hash:
62f353de5dbe93a4989fe359bd0f0e34
SHA1 hash:
c92c857d754c1ebf29f54e3f86349f357efcbf65
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
a498190b94552381c44c5dbb9ba1da7d3a020637a04f931c7f47e8f911de7c0c
MD5 hash:
630f363b3602785df1d82a143f2a8e2d
SHA1 hash:
3163469a20ec38fc3e055efa5e3856737b974ea4
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
e85d21a87f6f76885397935d6eb7f5cf440fb14e260de033f11afe58080725a5
MD5 hash:
ffab31a33082ec6035d14a209b42555d
SHA1 hash:
a71596470e50b4e030e702e7eed75691e84750b6
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
4caddcf77bf9e07044c3dc58f140f94790b39ff1418c25a274f239ac03aa8fa5
MD5 hash:
13a57f97face384977e5a19a8cf88110
SHA1 hash:
fc8978256810185100af04d09ae49142b0342d60
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
0716b94149d31952115f443062088d5add9d9a1be65ba1782a7212d819d5ab65
MD5 hash:
c9d6960e01c1c3ef6b00aa8975f96198
SHA1 hash:
133f79b280440d48dd9bb0cc2fb4ed53f921e7c5
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
88aaf3de537a91b970a8ba8e5cab90b67f6bcaeaf7b62fa87e50e23363a17a9d
MD5 hash:
6bed1ce58bafe3e7a0f0cd7211fe0f59
SHA1 hash:
2670a1f87e964f15ea7698c70c49b20149738619
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
b636f755798e90f7afad0b98b74dc76ef4315ba10d265534a0c7101f2010e2d3
MD5 hash:
39b0fd5c78a70a0baa840941599a482d
SHA1 hash:
93b2c8653301c51079bd3251591103154484cfc9
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
eaa78b4b86d067cc68bb33e3e2f4e8e1d7d6a404e44ee36332c190c740178194
MD5 hash:
a457fe3e307965c4f92d21678d26e8d2
SHA1 hash:
38d147af5a1409b35d2b90a33de73a6011afea95
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
bac4a3aa5831aa64a89b045b982ef0712a362d5363432d6903fda3d3778fb126
MD5 hash:
3a41a719d158f33fa0cb06dd9d06214f
SHA1 hash:
4d9a5b7d2708116e590559bf6d8500ca88d154df
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
Parent samples :
38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0
2ffaa635caf56eba07b1049bab35e1eff7211c35b38a40f71029581b266924b4
SH256 hash:
8846dae8e57379c37c9b029f35924587ebdbd8795cc2c357c5252894bb04bc64
MD5 hash:
2708e06d80098c65aa4d4ef616df681e
SHA1 hash:
97a719a66b6bfeacde6eb9979e6a31749dea3e22
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
abb71a5f4efc74ade3f4d100dcbf3d46531c31eb4a3dea595671325d2f5806f4
MD5 hash:
32bb023b59d610a592692a50d7ec8020
SHA1 hash:
611b457e045335c2608bd8d947458dab827efc20
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
dedd82538f91843a23aadb9f2899adbcddeddbf25de96a0d7f00646d15d7a406
MD5 hash:
0271892bd1f786a320e99a854bbeb6f2
SHA1 hash:
ab6ba68401c706537776b9033c936cfc5b70559e
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
24c2fad2f5ce797b5626bdfbe611dd3152bb50f0833f2c5d6672ef53a8587498
MD5 hash:
f4c7c97bdd63f40b05711120af3fda7b
SHA1 hash:
aa7b86067962ea693318021ba76c674aa7b8434e
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
bce25b4121d22e12c7742e59483a75988c2d06d967ed25c1857bdf5b8d86bf4a
MD5 hash:
5c5d7330708a3c769f55ce1be06fb269
SHA1 hash:
a42e677573de5952571325bdef7ab0abbed204fe
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
869390f703376c4316546904ee9daa3b7d29794b124075ffd33facfd55e2d3bf
MD5 hash:
67aae99e6c1f830dd103de9f8b863779
SHA1 hash:
4d86fa4e80408661afb461693e4c8d09af869673
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
f23ba33b587e05cbdc7446a1fd2eccbc3b2ae7d94684be3797ea9e21ccb57725
MD5 hash:
9cad97649d28497dfd17613594db8332
SHA1 hash:
7d060bd384bfee0ccd35738ba2317c57f49ad3d1
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
f5b3be5ba12756a4ded10544df93e1e2b9d1514099a2bb1d90c5472e2993ddaf
MD5 hash:
2b9311794700b169f84328979973c6b5
SHA1 hash:
17d67be4727b64bb016070737821674a306a7f36
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
70c5033e4e801cf08e4c1d23ce0180c0cf6aedbda36cffd4b068c2cea6084969
MD5 hash:
9ae226b1434c9247f185e005e800165f
SHA1 hash:
4ebd321ed8546f312fe873c4709e7ce24a900ee3
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
Parent samples :
38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0
2ffaa635caf56eba07b1049bab35e1eff7211c35b38a40f71029581b266924b4
SH256 hash:
994aeb9430bab25fade9ac86f4126ce783a43fcd7ad8b427688436fe45c44334
MD5 hash:
2a14c767bd261022acce31cad65ace6c
SHA1 hash:
431e476e0878bcad1d79aa4b9357d8e9bd74b776
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
959b07e066e67643adba7ea202700167dfb853797e62865a5609625800d8352b
MD5 hash:
fbeae8833a3f37d4d4cf351e19f4f797
SHA1 hash:
8da24dd8be65f0df56c7ad22fb4ca074cbe07bb5
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
3366191eb437289675fba6eb0fcc6c3825ebd9252715342b06cd2eabee007770
MD5 hash:
22eb10af308721e8b876d8bb0be68673
SHA1 hash:
cb4e2de444f23ff1af5942b4baf023402466202f
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
213e9ac5616e2bc302f549a9856026376112e34459cbb4cf3186fa03dd3882fe
MD5 hash:
fd2e3dcab3e7caed0f5865141cf4bca8
SHA1 hash:
d8d638f67683ac48e0e303622a054ee0da43a7b6
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
435932addd8d3f1c28583cdc2303259c08aaa1fe92a40576159e38b463de073c
MD5 hash:
9ddba21dd9049fb61815871ad6b952ec
SHA1 hash:
f30fc70ea9b87cdd576deba61adcc6c1b5554edb
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
230af80919c9abceb3e0654bcc22fbe2aabe458a1bd50c29b44588d74732fc68
MD5 hash:
f5cebd02b2c62900630ae36aee9096d5
SHA1 hash:
255499528e33c4fc3cb57ed92988249a05347cc2
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
Parent samples :
38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0
2ffaa635caf56eba07b1049bab35e1eff7211c35b38a40f71029581b266924b4
SH256 hash:
214bee6d180bf54b5bddb60a5c8f22db153e37091fbbf8eb81c9ed86872c4f7c
MD5 hash:
9b2f9a52ecfe84ca3e3ad1255bc16e7c
SHA1 hash:
a9fe5c7473d4b68ef41e45f765761fb575c77c1c
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
166dc1e11bc267ed248c798ec194662229be12d3e165328f3d2d1eabd8b43fff
MD5 hash:
5a38cd2474930369e7942cd514556fb5
SHA1 hash:
fb371319dc866a952d18ba57c73c488b38912d8c
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
ab78d191e89e170ddd623fc5c008c25245a8f22b5cfe4e267aaec68550acfa44
MD5 hash:
ad4264327562fdb9f0fa78edebf70d2d
SHA1 hash:
de15c869c97428ca3cafe81b70e1e9fcf29f7708
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
cd5f5475ac8ad9ab009c525a67b2364a930f97a6ab049b64e57b8d2987275259
MD5 hash:
e9c3905f61a19344daa4de9d828b7719
SHA1 hash:
ddf064dc8e40e42ee8d0b7e64c8807ccb85427d6
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
ae3efb38687f8f159cffa9ef026b3e9b5e88e6fba13982266c0c7971b6118d83
MD5 hash:
22671849a9e54716018e63c7fc82c237
SHA1 hash:
22f387c562fabbe32f671af79be9a77728e17e47
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
Parent samples :
38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0
2ffaa635caf56eba07b1049bab35e1eff7211c35b38a40f71029581b266924b4
SH256 hash:
ee06c7d526977fa72a5d0bf091fc75e0fc74cad6b429048d0507a41fab614144
MD5 hash:
48001536e2db30e5c4ad09886c9c615c
SHA1 hash:
1dc64b65a71dffde80feefb4eeb672b8745c4366
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
ff41b6f39b1469243377053a1dc475f53664b82c5c58b01e2c74d30d9bbabfe1
MD5 hash:
25d63a5db170e7226226485a4e04414d
SHA1 hash:
f9918b99d718ba43fe798d2b861a1c931c16d5e9
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
339bae6bc720ceae2000961212431f9abf63928c1272f0326ed7eca477100751
MD5 hash:
1d414626b4e831d97cc35582ca9e48ba
SHA1 hash:
38a06568ea5adada59d3c55cebe9c57013aebfb6
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
916e4f18c278d2a43445e9a8c42b2c55c1efe0be07a627a66d5b11faab334228
MD5 hash:
4a585679fd20390b67942fdcf59190b4
SHA1 hash:
65a9d0024eb8ce691f0d76c47950b99f1c75248d
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
17aa1a062305f0805eb2edef1a77030e732f87b4111cce17bfd2d4b6dae9ecb8
MD5 hash:
5fa8763cadf7823473d680e0f43a01bf
SHA1 hash:
47b8eb0ea9e73b4a343c4f573ff55f3c8b322b80
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
b856b9bc513bc524cbaf161ffb6f2d31c5d8e8b31e2c18e023434246fa1d60b6
MD5 hash:
bb5c4de5dcc6656f887773e24467e4d6
SHA1 hash:
0a9a8a574006ed261a46d3b07bb30baf05439111
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
SH256 hash:
fa5b46b1c8637ea53d7a89c21ba68c5586f1cec2119453c7b004abde24d3c0b6
MD5 hash:
27cb12b3210f40794929954716528dd8
SHA1 hash:
f070e5b1b44b445a15199ee0798673e87d7e7221
Link:
https://www.unpac.me/results/5e6a5aac-9247-41f4-92e1-ce99520556fd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:ClearWater_Ransomware
Create hunting rule
Author:Arrbat
Description:Detects ClearWater ransomware using a mix of family-specific names, 7-Zip SFX metadata, and anti-recovery indicators
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/76256/
  
URLhaus
https://urlhaus.abuse.ch/url/3891950/
  
Delivery method
Distributed via web download

Comments