MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78
SHA3-384 hash: f9b31d3d60df934476768fc0ce61ec627f57147bb34689c23ff76d0dc4fe9b57f2535e434c6f3d29a9aeb00a4996186c
SHA1 hash: 59fcece018e9ec61780e9c39f5c4160e6c98e679
MD5 hash: 7f63e33605db456d23ef7fa478f163b9
humanhash: chicken-equal-quiet-hawaii
File name:file
Download: download sample
File size:5'020'672 bytes
First seen:2025-11-30 01:32:06 UTC
Last seen:2025-11-30 03:21:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4001d25cc44a5146e1045bfe56dee420
ssdeep 98304:J2YgpA79tqLqWox4dmbDaapjar2hKYADYAZSsz5wPISRMS5kB9AH:t4dmbjpjar2hVb65NC2i
TLSH T15536E047E2A320ECC56BC174476B6772F931B8591134BE7FA594CB302F22E506B2EB25
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543


Avatar
Bitsight
url: http://178.16.55.189/files/7103746036/PHhehGC.exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
97
Origin country :
US US
Vendor Threat Intelligence
Malware family:
teamviewer
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-11-30 01:33:46 UTC
Tags:
stealer teamviewer rmm-tool tightvnc
Link:
https://app.any.run/tasks/4edf4c14-ab90-4c85-b158-a2b4cf931ed7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/41879/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692b9ea0f9fd2d5f941f1618
Tags:
dropper lien remo hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Searching for synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Creating a file in the %temp% directory
Launching a process
Reading critical registry keys
Creating a window
Using the Windows Management Instrumentation requests
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto expand fingerprint lolbin packed packed stealer
Link:
https://www.filescan.io/uploads/692b9e9e1b65ca0bb927aed8/reports/b3e3be64-59d8-4a10-9431-d5e405f8f554/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78
Result
Gathering data
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/66b7447b-74c5-4682-8a88-c9168992f9b4
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/7f63e33605db456d23ef7fa478f163b9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78/
Verdict:
Malicious
Threat:
Trojan-PSW.Win32.Lumma
Link:
https://tip.neiki.dev/file/8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rt433hoqoy26a6uoknftqnk676tnlspznwmyhayltocaviitr54a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
credential_access discovery spyware stealer
Link:
https://tria.ge/reports/251130-bx3e1sdv4c/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Credentials from Password Stores: Windows Credential Manager
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7e989502-36b1-4828-9164-24cae902940f
Unpacked files
SH256 hash:
8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78
MD5 hash:
7f63e33605db456d23ef7fa478f163b9
SHA1 hash:
59fcece018e9ec61780e9c39f5c4160e6c98e679
Link:
https://www.unpac.me/results/3b849069-ee2c-43ef-8f95-41258b20f65e/
Malware family:
ReflectiveLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8cf9bd9dd076/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Debugger
Create hunting rule
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:has_telegram_urls
Create hunting rule
Author:Aaron DeVera<aaron@backchannel.re>
Description:Detects Telegram URLs
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 8cf9bd9dd07635e07a8e534b38355effa6d5c9f96d9983830b9b840aa1138f78

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3720769/
Cape
Cape
https://www.capesandbox.com/analysis/41879/

Comments