MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ccb7f63df4247bbe86f4c6dcea7ed51a17e0d5eea9843c29d2ef05d8208067e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ccb7f63df4247bbe86f4c6dcea7ed51a17e0d5eea9843c29d2ef05d8208067e
SHA3-384 hash: e506bcf6cafd2a3a4cbaf236a46d8161cfe444afc532a3b5a478575b1ac5a118c77a67b5ec4a12058f6d3c63d7a41925
SHA1 hash: 80ab925b0cdf8d94e63e033792a7eac29a2e6f7e
MD5 hash: f4c200dff264f6b702cba19e1e42e602
humanhash: skylark-kitten-magazine-vermont
File name:f4c200dff264f6b702cba19e1e42e602.exe
Download: download sample
File size:7'030'088 bytes
First seen:2023-05-09 06:53:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b5552dccd9d0a834cea55c0c8fc05be (16 x LunaLogger, 16 x BlankGrabber, 8 x CrealStealer)
ssdeep 196608:rvjDRIdDUvQd9Z7FTLXfIz3wb7bAiUtIwQaUYrTafjr:D4sQ/tFO3w7snlQah4jr
Threatray 225 similar samples on MalwareBazaar
TLSH T17066339963500CE1FC1A033A69828511FD637D2A1764FE9B426071292E7F7E3AD79F83
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon f0ccaa694de8d4f0
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
237
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f4c200dff264f6b702cba19e1e42e602.exe
Verdict:
No threats detected
Analysis date:
2023-05-09 07:01:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e2a59e3e-2047-4538-a06c-84b6dec0a018

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/387695/
Detection(s):
SecuriteInfo.com.HEUR.Trojan-PSW.Python.Agent.gen.8588.26986.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/83159/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/6459ee0fd054a0b0ef842c7d/reports/0c0a9632-ca47-448f-a82b-183e87ed2bb8/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/7ccb7f63df4247bbe86f4c6dcea7ed51a17e0d5eea9843c29d2ef05d8208067e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0aa76117-7862-41a5-bc4e-565107519dfb
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1228904
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ccb7f63df4247bbe86f4c6dcea7ed51a17e0d5eea9843c29d2ef05d8208067e/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-05-09 06:54:10 UTC
File Type:
PE+ (Exe)
Extracted files:
12
AV detection:
11 of 37 (29.73%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ptfx6y67ijd3x2dpjrw45j7nkgqx4dk65kmehqu5f3yf3aqiaz7a._file
Verdict:
malicious
Similar samples:
5d17781561881f8c412498515db843561d6a8971009431f390de99b3a46ec4bc
607edff63e117372cc0d9693cee07029c56f1f7d7dd4443182599d2d2328e341
6ce60efbd50f755eb8ab0c3093fadff5d7e7b594710df3788cd4e45fb8e2e6f6
73d7458f2325b5cf6ddc5bd22fba550654447ca0086c77e72bfebe909ae36541
9d85f7e7bbce1fc023353548d2bd1a54223370ccc64f073bcd473545aa36f6bc
b76165845798adbba7f4070b2e4543e8fbfc9a0282273bd791f39619eee19770
c80d223df0de1e01dbd9105850ac206410396555c0b187d261bc7b695d63cdb3
cb7dd8a894f38086b5b5ff3ef215acac3ea0190b2347911912cd36c12483fc72
d2803b97a3cdb1787df9e3bd60818968fecb86bf7eb48bfa51e0757f055b95e4
+ 215 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/230509-hn8c8sef48/
Unpacked files
SH256 hash:
7ccb7f63df4247bbe86f4c6dcea7ed51a17e0d5eea9843c29d2ef05d8208067e
MD5 hash:
f4c200dff264f6b702cba19e1e42e602
SHA1 hash:
80ab925b0cdf8d94e63e033792a7eac29a2e6f7e
Link:
https://www.unpac.me/results/9a0e1cc7-a79c-482e-8e52-5830b1bd8821/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.
Rule name:SUSP_Imphash_Mar23_3
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 7ccb7f63df4247bbe86f4c6dcea7ed51a17e0d5eea9843c29d2ef05d8208067e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2532826/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/387695/

Comments