🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fd8743d7db3b41fd686d8225cee3937cee621ee1fee933cd5734be2ddd9eb7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CobaltStrike


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fd8743d7db3b41fd686d8225cee3937cee621ee1fee933cd5734be2ddd9eb7f
SHA3-384 hash: e2d08c76e47ddd655f2d00778b1444d462b7a23eabbfc5869babe52d41cb5068fb3e6104b6468c97f4b8b3c58c009578
SHA1 hash: ccff447979820f332f5273b99d61e472129efada
MD5 hash: c1c14116d65607f73749b67d99075842
humanhash: minnesota-black-river-november
File name:SecuriteInfo.com.Trojan.Siggen10.59370.11657.8581
Download: download sample
Signature CobaltStrike
Create hunting rule
File size:10'949'312 bytes
First seen:2024-02-29 03:20:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a2811931084b6dcda3f7edcb0d2009ac (1 x CobaltStrike, 1 x Mirai, 1 x SimpleHelp)
ssdeep 196608:i+0iHnDSu5gTe3p2VLyMCLLtgQIJQSG5t2FUJti8wHMgIu+z7Ogm5HIjJIJ:i+7HVmTe52VGMCXW+5I9dMgm8HIjJs
Threatray 2 similar samples on MalwareBazaar
TLSH T1E4B6336362E2AE71CA8F66B9728BC375DA33B2220307D5C397F4098DAD7C3475639146
TrID 32.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.7% (.SCR) Windows screen saver (13097/50/3)
11.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 72fcb0a2a0b0f07c (9 x SimpleHelp, 4 x Mirai, 1 x CobaltStrike)
Reporter SecuriteInfoCom
Tags:Cobalt Strike exe signed

Code Signing Certificate

Organisation:SimpleHelp Ltd
Issuer:Thawte Code Signing CA - G2
Algorithm:sha1WithRSAEncryption
Valid from:2013-11-20T00:00:00Z
Valid to:2015-12-20T23:59:59Z
Serial number: 6e482bf848a60c849477f7471b542310
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 4ea23b6773b065aaca03cfaabc44921029e98b6b9f2feeb79a254b7035a20a5c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
386
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/478221/
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.59370.11657.8581.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint lolbin masquerade overlay packed shell32
Link:
https://www.filescan.io/uploads/65dff820f73edfc477ffbcfa/reports/9519f30b-6c5b-4c8b-a5eb-5ffa6dcf1981/overview
Verdict:
Malicious
Labled as:
TrojanSpy.Xegumumune
Link:
https://www.hybrid-analysis.com/sample/7fd8743d7db3b41fd686d8225cee3937cee621ee1fee933cd5734be2ddd9eb7f
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6ed942f0-d3ad-4437-9992-382f9d87b0d3
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
51 / 100
Link:
https://www.joesandbox.com/analysis/1400674
Signature
Found stalling execution ending in API Sleep call
Installs a global keyboard hook
Java source code contains very large array initializations
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Submitted sample is a known malware sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1400674 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 29/02/2024 Architecture: WINDOWS Score: 51 50 Multi AV Scanner detection for dropped file 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 Java source code contains very large array initializations 2->54 8 SecuriteInfo.com.Trojan.Siggen10.59370.11657.8581.exe 744 2->8         started        process3 dnsIp4 48 67.43.111.12, 49710, 49711, 49717 CITIZENS-ISPUS United States 8->48 40 C:\...\SimpleHelp TechnicianWinLauncher.exe, PE32 8->40 dropped 42 C:\Users\user\AppData\...\unpack200.exe, PE32 8->42 dropped 44 C:\Users\user\AppData\...\jpiexp32.dll, PE32 8->44 dropped 46 57 other files (13 malicious) 8->46 dropped 56 Submitted sample is a known malware sample 8->56 58 Found stalling execution ending in API Sleep call 8->58 13 SimpleHelp Technician.exe 8->13         started        16 SimpleHelp TechnicianLauncher.exe 8->16         started        18 cacls.exe 1 8->18         started        20 20 other processes 8->20 file5 signatures6 process7 signatures8 60 Installs a global keyboard hook 13->60 22 cacls.exe 13->22         started        24 cacls.exe 16->24         started        26 conhost.exe 18->26         started        28 conhost.exe 20->28         started        30 conhost.exe 20->30         started        32 conhost.exe 20->32         started        34 5 other processes 20->34 process9 process10 36 conhost.exe 22->36         started        38 conhost.exe 24->38         started       
Score:
53%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/7fd8743d7db3b41fd686d8225cee3937cee621ee1fee933cd5734be2ddd9eb7f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fd8743d7db3b41fd686d8225cee3937cee621ee1fee933cd5734be2ddd9eb7f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p7mhipl5wo2b7vug3arfz3rzg7homipod7xjgpgvonf6fxoz5n7q._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
95214d9b5c1664031bfd15faea7dff8d9eddbb4907d1b3bcfbcfd79c920e9e56
CobaltStrike
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/240229-dwbl1scb3y/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
2b9b5a8a1dd5b8af02989f7adae40acf743398f3b9c87510e6df23bae92cbff3
MD5 hash:
7034bf2f60b639a6e80947f6f4f1fa76
SHA1 hash:
ca0413f4675ab642490d80c82a6d575d2e355d35
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
aca72f7bc2e9e8ae1c151b400443259a40e4862fcccf4cc510f6925929af8031
MD5 hash:
b7d720a0e845e7f302d5b056c258dc7a
SHA1 hash:
adddd4000d6492ebb5910c8fe24ede1af6c6825d
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
b0ebc97e0521aceaf3cc4d85ba77278f7989a7b82b9da691289cfcb931a24514
MD5 hash:
d3e12324b8c062758928d8c75b068009
SHA1 hash:
6de87d860455c29acfd0f38ea3ea81e6dafe1fed
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
eeb19b428fb66fb45e5c010e253ab7e1169d85b1c0454760335b0ac9cd56752e
MD5 hash:
596f298f2eff4d36341184aa6a3e885e
SHA1 hash:
343c12750f61ac913521d51f0a1a4deb5756f9c0
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
13183cb03f33e4a2b5ccf8ea0237b23b7dfe1b4a01ad81652b0ed4109d853822
MD5 hash:
14d868626f0690283c923270fc5a67b9
SHA1 hash:
22477b0147181cdb75d9542415a92cb7ab911669
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
a4541fc15ef49f8a2b310e6ee0a7a7ee086a1eae37d92f8a60bbeeb799add5f5
MD5 hash:
31cca70e18f97fbdecc1d31d012be8b1
SHA1 hash:
b831138d92121ace7e1c476586235628688f2363
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
fa5d921355faeeb41c1a898618cf180d0539284448bd2cc6c2890ec12eb0e16c
MD5 hash:
55fcb6e3587c96b8c13eeee2969b9352
SHA1 hash:
2172e00e5bebbaf9f61e39eb060501a5930173f0
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
cf618bda35b773deb921bd6a29579664049ee081963084f49722b1fefeaf2de4
MD5 hash:
badd667016c09eb31096220ff0649c12
SHA1 hash:
f021b7a9982e441bc54708af343cfeed5cb5bfae
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
516a6fa8020056c5098fbd6fbf615a1a250d7e97e4bf61c05d0201f163ff0ce8
MD5 hash:
eecd1702a3f3183bd4815291a2e5fa3d
SHA1 hash:
e19d6a1c5840d2a8b7c99b665756685a42ea9700
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
6883508a789b6ed3529d90d660138178cd0927e38f252caa7ce7fa147fa8ea41
MD5 hash:
280a973335d93ef5c00ead67633713aa
SHA1 hash:
b2457da2d2ee2ada3309e663795f0f536c5536ef
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
ed78b54b6506016de05aab39164d739897df5595bc46c5a9213520ce90aac013
MD5 hash:
c5dc40f71d437c6564a107043a4770b7
SHA1 hash:
02202b1977884f903b6ea10518b8084eda6da365
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
b0fb23643b4e59e75c791cd4cd3c2569c293d075bacb94400ff8a936f07f8346
MD5 hash:
ef0faa62565c1f09cf5204513dbf07a6
SHA1 hash:
fb8facfc3c110397d05d46dde73d087f195c4985
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
a01a7503680b260f75e922d1158c49f810dc65bb7d4f4b3d10f4013d14875459
MD5 hash:
31c012d5870c38321eac1a1f12620938
SHA1 hash:
bd5d88706995b3f11de430771af3b13a82b77396
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
dbb07daf653d3acf77c612ff10b7eabb48ff9cca631be1531af30da422f1dd08
MD5 hash:
edbb482cf29eca882b5c24efbf050e15
SHA1 hash:
5c1fbb1535696d145b76710339900a5f2030a81f
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
d02bc4509bdcfa9146357f3569b2f7dac0c3c2bc7633dc6b18fa003c8657a88d
MD5 hash:
e7d4cdcdb95b3dd8f251c12bfd0035a0
SHA1 hash:
5597ea07cb67a960dc0319659f4818c4bbdd568c
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
e22f22875dd4af7af3811ae49350cce3e47e37f24b145922082caad2a566abf8
MD5 hash:
596231d9325804292fe77b74453f22b9
SHA1 hash:
1bcd99e8b0f0dc73e6c9a98f9f5f3cac2e52aadb
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
SH256 hash:
7fd8743d7db3b41fd686d8225cee3937cee621ee1fee933cd5734be2ddd9eb7f
MD5 hash:
c1c14116d65607f73749b67d99075842
SHA1 hash:
ccff447979820f332f5273b99d61e472129efada
Link:
https://www.unpac.me/results/aebbd639-d41b-48e3-a1bc-73d3cdcaafbd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7fd8743d7db3b41fd686d8225cee3937cee621ee1fee933cd5734be2ddd9eb7f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/478221/

Comments