MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fd7522643ce8c67ed5ca7a58eba5451dc802cfc054c36f3cb89d073976c9676. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Bitter


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9fd7522643ce8c67ed5ca7a58eba5451dc802cfc054c36f3cb89d073976c9676
SHA3-384 hash: 426e9ef8e245b13f8ee72c970606cc91399549f1904c39b443b5e19e216a234febe0a0f9961dc02068beedff16eea7cf
SHA1 hash: 46428480d79454c775310d2acfe953a2d7a81770
MD5 hash: 5c9f2b56ab3724e2d31540c389484db8
humanhash: harry-mango-ack-wyoming
File name:9fd7522643ce8c67ed5ca7a58eba5451dc802cfc054c36f3cb89d073976c9676
Download: download sample
Signature Bitter
Create hunting rule
File size:13'264 bytes
First seen:2024-12-31 10:23:06 UTC
Last seen:Never
File type:
MIME type:application/octet-stream
ssdeep 96:Qac0hAaZ0OGHdlBgTNcK/SxpzUpklrzXZ+QDeP1csIr0sirRhEaD38DfKLuM2Ifz:QaBdIg74powzRDTMrnEaA0J7
TLSH T1A5525C3022514220D56ACE73BDEAD78636347A01DD59C58D5159A72D0CEF80D6ABE0FF
TrID 81.0% (.CHI) Windows HELP Index (17144/6)
18.9% (.CHM) Windows HELP File (4000/1)
Magika chm
Reporter Bugs_Bunny
Tags:apt Bitter BitterElephant chm

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PUA.JS.Obfus-2179.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.JS.Obfus-2525.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6773c7341ada70779824c6b9
Tags:
autorun cryxos
Result
Verdict:
Malicious
File Type:
CHM File - Malicious
Link:
https://app.docguard.net/9fd7522643ce8c67ed5ca7a58eba5451dc802cfc054c36f3cb89d073976c9676/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Labled as:
Exploit.CHM
Link:
https://www.hybrid-analysis.com/sample/9fd7522643ce8c67ed5ca7a58eba5451dc802cfc054c36f3cb89d073976c9676
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/9fd7522643ce8c67ed5ca7a58eba5451dc802cfc054c36f3cb89d073976c9676
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9fd7522643ce8c67ed5ca7a58eba5451dc802cfc054c36f3cb89d073976c9676/
Threat name:
Document-HTML.Trojan.Runner
Create hunting rule
Status:
Malicious
First seen:
2024-12-31 10:28:04 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
8 of 38 (21.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t7lvejsdz2ggp3k4u6sy5osukhoialh4avgdn46lrhihhf3msz3a._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/241231-mhm8bswmbs/
Behaviour
Modifies Internet Explorer settings
Scheduled Task/Job: Scheduled Task
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Bitter RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9fd7522643ce8c67ed5ca7a58eba5451dc802cfc054c36f3cb89d073976c9676

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CHM_File_Executes_JS_Via_PowerShell
Create hunting rule
Author:daniyyell
Description:Detects a Microsoft Compiled HTML Help (CHM) file that executes embedded JavaScript to launch a messagebox via PowerShell

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://x.com/suyog41/status/1874032029656113580

Comments