MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cc75a8bc7800351206df44ff80d1e997237120587763c870697313ba95084b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments 1

SHA256 hash:	7cc75a8bc7800351206df44ff80d1e997237120587763c870697313ba95084b4
SHA3-384 hash:	1376e36811445dca56b5847fedfb5c482eee0db038a0e58684538bbededf339c2ab4b3c8e2fb9b87f64e069294beb2df
SHA1 hash:	c8298231fd11d45e6f90364c9d8db1598c7bd819
MD5 hash:	3bfc3c373967beea39f3896394a0516b
humanhash:	magazine-mars-blue-gee
File name:	shark.bin
Download:	download sample
File size:	4'061'290 bytes
First seen:	2025-04-17 19:48:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	64ac51d1685ad065533ce20c965f06ba
ssdeep	98304:rhGm3gmh01MeNfovpHLZySrEfwCU5zCiwpDeNfovpHLZySrEfwCr:FG2+qedgZYfwCU5eiwpDedgZYfwCr
TLSH	T16816232177E18075F1F72A7199B75A31AB767E722E31CA0F57E016160E32AC1C93A723
TrID	39.5% (.EXE) InstallShield setup (43053/19/16) 28.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 9.6% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
dhash icon	617866f39898c1e4 (3 x Formbook, 1 x SnakeKeylogger, 1 x Stealc)
Reporter	aachum
Tags:	185-209-30-91 exe Shark

iamaachum

https://h1.wildlifeautograph.shop/shark.bin

Intelligence

File Origin

# of uploads :

# of downloads :

556

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

77003ff3-ce68-4ef7-aa68-f6f94d795986

Verdict:

Malicious activity

Analysis date:

2025-04-17 19:52:30 UTC

Tags:

autoit stealer autoit-loader loader advancedinstaller auto-reg

Link:

https://app.any.run/tasks/77003ff3-ce68-4ef7-aa68-f6f94d795986

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/2759/

Detection(s):

SecuriteInfo.com.Hoax.Win32.ArchSMS.shv.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680160fa2203b3e10cd08090

Tags:

injection dropper virus

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Creating a file

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Setting a single autorun event

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context crypto evasive explorer fingerprint fingerprint lolbin masquerade microsoft_visual_cc msiexec overlay packed packed packer_detected

Link:

https://www.filescan.io/uploads/68015b0890767142c3d997dd/reports/cde1c21d-6f85-44a1-bf0c-90c3ec611ea7/overview

Verdict:

Suspicious

Labled as:

Trojan.GenHeur

Link:

https://www.hybrid-analysis.com/sample/7cc75a8bc7800351206df44ff80d1e997237120587763c870697313ba95084b4

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b1d433b0-0899-4667-82e7-2fa5e891f0a8

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

35 / 100

Link:

https://www.joesandbox.com/analysis/1667892

Signature

Found API chain indicative of debugger detection

Behaviour

Behavior Graph:

Download SVG

Score:

78%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7cc75a8bc7800351206df44ff80d1e997237120587763c870697313ba95084b4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7cc75a8bc7800351206df44ff80d1e997237120587763c870697313ba95084b4/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ptdvvc6hqabvcidn6rh7qdi6tfzdoeqfq53dzbygs4ytxkkqqs2a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery persistence

Link:

https://tria.ge/reports/250417-yjajeasns7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Adds Run key to start application

Executes dropped EXE

Verdict:

Suspicious

Tags:

ta_abused_service

YARA:

n/a

Link:

https://app.threat.zone/submission/155325f1-e4fe-47cb-a13d-492dd11eba1e

Unpacked files

SH256 hash:

7cc75a8bc7800351206df44ff80d1e997237120587763c870697313ba95084b4

MD5 hash:

3bfc3c373967beea39f3896394a0516b

SHA1 hash:

c8298231fd11d45e6f90364c9d8db1598c7bd819

Link:

https://www.unpac.me/results/5c48bff2-e778-42ab-9b53-263f2acb219c/

SH256 hash:

25c027fa14602412c0692c619e5e6b696a5ddaa4577364989a098fb7605feb6f

MD5 hash:

7fe03d84ca384aa478bcdf4ba3558983

SHA1 hash:

e7bf3412cb9747a4bf92639a9290a70642f0fd6d

Link:

https://www.unpac.me/results/5c48bff2-e778-42ab-9b53-263f2acb219c/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7cc75a8bc780/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

exe 9f0499b0c6aa625b84052ed034de82dcb48af02bbd340e8fd87693a1b70b5db4

exe 7cc75a8bc7800351206df44ff80d1e997237120587763c870697313ba95084b4

(this sample)

Link

https://tria.ge/250417-yd6pnazyb1/behavioral2

Dropped by

SHA256 9f0499b0c6aa625b84052ed034de82dcb48af02bbd340e8fd87693a1b70b5db4

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/2759/

URLhaus

https://urlhaus.abuse.ch/url/3516483/

Dropped by

MD5 7c53d35107b9b2348dddd729621adeec

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteW SHELL32.dll::ShellExecuteExW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW KERNEL32.dll::CreateProcessA KERNEL32.dll::OpenProcess KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetDriveTypeW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileW KERNEL32.dll::DeleteFileA
WIN_USER_API	Performs GUI Actions	USER32.dll::EmptyClipboard USER32.dll::FindWindowW USER32.dll::OpenClipboard USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2025-04-17 19:59:33 UTC

C2: 185.209.30.91