MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cf8c53adb466b11b1c5af6c77cc4ea154f59c04e7085e6308f6cc45e4c02e17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cf8c53adb466b11b1c5af6c77cc4ea154f59c04e7085e6308f6cc45e4c02e17
SHA3-384 hash: 029c5f948f5066cd15c4cb8dc0ce2cb23ee529b702fa8983b9efab02a6c4b809618a7c848cc3f9ebe0bde43c8aa47813
SHA1 hash: 0e7d28ce5f14a444dccb48f9b3db20c889560e15
MD5 hash: abd5b8d98f40676301f632d3045b7864
humanhash: nineteen-twenty-venus-jig
File name:file
Download: download sample
File size:14'533'120 bytes
First seen:2023-06-20 13:06:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 57c9b357ae0cb2f414b0a5873e2f216d
ssdeep 98304:9XUbcXD7go3FlWZk4U9xEwX/4zHSwiQf8J/zW:9koXXgofz4UchzHj
Threatray 211 similar samples on MalwareBazaar
TLSH T1ECE65B07F89191E5C0AED270CA269262BA303C445F3067D73B24FBB92B76BD85B79354
gimphash 05ac73c4e475e844de3cfd27725b2fea52351806212c1cdcaa16cc141858f924
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter jstrosch
Tags:exe X64

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://mithransilks.com/download/File_pass1234.7z
Verdict:
Malicious activity
Analysis date:
2023-06-18 20:57:24 UTC
Tags:
privateloader opendir evasion loader rat redline stealer fabookie amadey trojan smoke gcleaner ransomware stop miner vidar
Link:
https://app.any.run/tasks/e3d07a5b-721b-4c2e-8a09-f07676545b55

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.100014.16264.21089.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Reading critical registry keys
Running batch commands
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug greyware
Link:
https://www.filescan.io/uploads/6491a47799f0c0cb0932f327/reports/17f3cf9a-5617-44bc-b2c8-3767403e2646/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/7cf8c53adb466b11b1c5af6c77cc4ea154f59c04e7085e6308f6cc45e4c02e17
Result
Verdict:
MALICIOUS
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/41498bec-e41b-479d-a5c5-08e315c6ace4
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1258222
Signature
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 891243 Sample: file.exe Startdate: 20/06/2023 Architecture: WINDOWS Score: 52 16 Multi AV Scanner detection for submitted file 2->16 7 file.exe 2->7         started        process3 signatures4 18 Tries to harvest and steal browser information (history, passwords, etc) 7->18 10 cmd.exe 1 7->10         started        process5 process6 12 conhost.exe 10->12         started        14 choice.exe 1 10->14         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7cf8c53adb466b11b1c5af6c77cc4ea154f59c04e7085e6308f6cc45e4c02e17/
Threat name:
Win64.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2023-06-17 15:31:49 UTC
File Type:
PE+ (Exe)
AV detection:
22 of 37 (59.46%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pt4mkow3izvrdmofv5whptcoufkplhae44ef4yyi63gelzgafylq._file
Verdict:
malicious
Similar samples:
37f4de4ac5d64d68e8c468d06ccc1cee1142894dbd87e63a6a53a3098db6e747
3d9ffc27500e20102800e24fb92fda87c6228bd2cacc9a9c660442c84fa0ce18
59f6e559d4053e7b5358708d5c6ac677889ba5702ef8e71fb64bd11494cf5c58
621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a
68ec885eabd2ac076ea588d4cf827eaa83e518d5a4c0578ee73bf0daa4ef9b67
6ee6ee45d3ece9254facb6b715189ea03ede981438929fc56f77e691681a66a1
9b4e2523db1dda989afb99ec80d452f4745c53246bad523763098af883d205de
b8228fd853e3c6c8dd061b1d0c2eceb6600d97cb7f65530bc37f091fcf40dfe0
c0bdd07daeb73c3739f70f84b9ed6dda1c45c305ac3c9edb152c2ac07286a517
c76a3ac180addf9f1743159b4a66b12f313c4d59d9a7b1270a7877aa443a8804
+ 201 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230620-qcmw6aca94/
Behaviour
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
7cf8c53adb466b11b1c5af6c77cc4ea154f59c04e7085e6308f6cc45e4c02e17
MD5 hash:
abd5b8d98f40676301f632d3045b7864
SHA1 hash:
0e7d28ce5f14a444dccb48f9b3db20c889560e15
Link:
https://www.unpac.me/results/3e3fa5ed-2a6a-4ccf-9c49-ef86a61dc985/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7cf8c53adb466b11b1c5af6c77cc4ea154f59c04e7085e6308f6cc45e4c02e17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 7cf8c53adb466b11b1c5af6c77cc4ea154f59c04e7085e6308f6cc45e4c02e17

(this sample)

  
Delivery method
Distributed via web download

Comments