MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 989448c49aa2cf2e4b4726d866b6852bb3c19d7d6d2f8f2ff867cde7c0769c6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 989448c49aa2cf2e4b4726d866b6852bb3c19d7d6d2f8f2ff867cde7c0769c6f
SHA3-384 hash: 28b5d19708590692f94f13bee40239385041af9e38123eaef8b479d33cd8c7d1d4306a3b344e002623c15b60ffbc8034
SHA1 hash: 6e04c4fa707a10d92d15592fb02b9103cc1b1ffe
MD5 hash: 1e57467bf14b5dead86545689fd263ca
humanhash: happy-mirror-kentucky-virginia
File name:cleo.zip
Download: download sample
File size:32'482 bytes
First seen:2024-12-10 14:34:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:IPJ/364Z7wtkD3U0dxLQWfSlUwTtB0mg5eTH+B0YR3:0Q4ik3dBQWfoB3H+yY
TLSH T150E2C034EE485801CB1F64B0D7BCC00CD5CFEA46B14B8717298746A5E4298DB6A39FDE
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter X__Junior
Tags:cleo zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
EG EG
File Archive Information

This file archive contains 12 file(s), sorted by their relevance:

File name:Mos
File size:1'030 bytes
SHA256 hash: 0b7b1b24f85a0107829781b10d08432db260421a7727230f1d3caa854370cb81
MD5 hash: ee7acd7a8a5795308942f094c950de6f
MIME type:application/x-java-applet
File name:MANIFEST.MF
File size:101 bytes
SHA256 hash: f43db637402f14eb19fa7e06afb481fa2f5bb34eb9103e2aa7724c0e6a896c2f
MD5 hash: 899a84b6e7ec5369b95a5a8849eaa3f8
MIME type:text/plain
File name:ScSlot
File size:1'411 bytes
SHA256 hash: 87f7627e98c27620dd947e8dd60e5a124fdd3bb7c0f5957f0d8f7da6d0f90dee
MD5 hash: 6ff85e7bec211869073b969dbd10c8eb
MIME type:application/x-java-applet
File name:DwnLevel
File size:342 bytes
SHA256 hash: f80634ce187ad4834d8f68ac7c93500d9da69ee0a7c964df1ffc8db1b6fff5a9
MD5 hash: 7dcaffc9c26fe9e08e9b66e05c644cfc
MIME type:application/x-java-applet
File name:Cli
File size:5'552 bytes
SHA256 hash: 0c57b317b572d071afd8ccdb844dd6f117e20f818c6031d7ba8adcbd32be0617
MD5 hash: fa0ffca3597af31fc196ca27283aa038
MIME type:application/x-java-applet
File name:Slot
File size:3'364 bytes
SHA256 hash: 1e351bb7f6e105a3eaa1a0840140ae397e0e79c2bdc69d5e1197393fbeefc29b
MD5 hash: d924ffd1f2952a03da29c0a7a33e6a54
MIME type:application/x-java-applet
File name:main.xml
File size:4'630 bytes
SHA256 hash: b103f708e85416fc6d7af9605da4b57b3abe42fb9c6c9ec0f539b4c877580bd2
MD5 hash: cb2442a535179feff6cc9753f186424d
MIME type:text/xml
File name:Dwn
File size:5'541 bytes
SHA256 hash: 429d24e3f30c7e999033c91f32b108db48d669fde1c3fa62eff9da2697ed078e
MD5 hash: 510a7fa9d425f1c3a38ad81d813b3f17
MIME type:application/x-java-applet
File name:Proc
File size:10'251 bytes
SHA256 hash: 1ba95af21bac45db43ebf02f87ecedde802c7de4d472f33e74ee0a5b5015a726
MD5 hash: 37a761f4d02577cf6789676f87cb9fc6
MIME type:application/x-java-applet
File name:SFile
File size:1'870 bytes
SHA256 hash: 57ec6d8891c95a259636380f7d8b8f4f8ac209bc245d602bfa9014a4efd2c740
MD5 hash: ca3de6f055f94acc87c6d335d9cc5c04
MIME type:application/x-java-applet
File name:start.class
File size:5'032 bytes
SHA256 hash: a6be2e5f95bf5b26ed013d5af8dde8dd98f836a9140af29c68b59643675b6eb4
MD5 hash: 186c2479dabe48f21670040e1cace592
MIME type:application/x-java-applet
File name:SrvSlot
File size:14'426 bytes
SHA256 hash: f4e5a6027b25ede93b10e132d5f861ed7cca1df7e36402978936019930e52a16
MD5 hash: bcc1bf75e0be3efabbd616cc8cfa8c35
MIME type:application/x-java-applet
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=675853164a662cb52657f58d
Tags:
malware
Result
Verdict:
Clean
File Type:
XML File
Link:
https://app.docguard.net/989448c49aa2cf2e4b4726d866b6852bb3c19d7d6d2f8f2ff867cde7c0769c6f/results/dashboard
Verdict:
Unknown
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6758519ab8fd6a23b4d66ad2/reports/eaa43824-9070-4d7f-aad4-d0e33ea1b22f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/989448c49aa2cf2e4b4726d866b6852bb3c19d7d6d2f8f2ff867cde7c0769c6f
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/989448c49aa2cf2e4b4726d866b6852bb3c19d7d6d2f8f2ff867cde7c0769c6f
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Hidden Powershell
Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/989448c49aa2cf2e4b4726d866b6852bb3c19d7d6d2f8f2ff867cde7c0769c6f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/989448c49aa2cf2e4b4726d866b6852bb3c19d7d6d2f8f2ff867cde7c0769c6f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tckerre2ulhs4s2he3mgnnuffoz4dhl5nuxy6l7ym7g6pqdwtrxq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/241210-tlsesavldp/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/989448c49aa2cf2e4b4726d866b6852bb3c19d7d6d2f8f2ff867cde7c0769c6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CommonBase64ReverseShellStrings
Create hunting rule
Description:Detects common powershell base64 reverse shell strings
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)
Rule name:SUSP_PS1_JAB_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Comments