🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8fbdf962064abcda04658c707b65ae698e80d62d2d9d9eaeef3a36febf20c8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8fbdf962064abcda04658c707b65ae698e80d62d2d9d9eaeef3a36febf20c8c
SHA3-384 hash: e09c0f6b1deaef9bf50f5eab3765d1bfb03a9ecf1a1064be1eddcfaf37831959734ee586e217e25ef08de50d30b3ae3b
SHA1 hash: ad6588d8d44b35045acac1b9e76193beb660d96e
MD5 hash: 194c736194e6d85bbcc773d1fbbcd1f5
humanhash: east-lactose-coffee-fix
File name:archive-200424-08_04_57.zip
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:4'025'600 bytes
First seen:2024-05-01 17:44:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:7sYxCPqo/TwSfkfYkNuBnmi17ihKnZbxTud:787pcfqsKn51C
TLSH T10A16F0AC70F5B85EF5D4437BC6862CF6DB2CA500D7A93D9B8E2041567D8310EAF6E860
TrID 54.5% (.USDZ) Universal Scene Description Zipped AR format (generic) (6000/1/1)
36.3% (.ZIP) ZIP compressed archive (4000/1)
9.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter izpir
Tags:file-pumped PrivateLoader Redline Stealc vidar zgRAT zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
249
Origin country :
ES ES
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:hash.bin
File size:361'472 bytes
SHA256 hash: 61a288622785c57259acc1ac70a55a023b9e738a39effd89926f7cac0e68b204
MD5 hash: d3eb0ac69f6dc7790173d4c51e75fbd3
MIME type:application/octet-stream
Signature PrivateLoader
File name:setup.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:797'966'336 bytes
SHA256 hash: 1a3a7443f45a59861ded875d71008047733d16858752922984e501fd6e9ee639
MD5 hash: 8b49259ef128f26ba1c329bd0a0d29fe
De-pumped file size:5'614'608 bytes (Vs. original size of 797'966'336 bytes)
De-pumped SHA256 hash: cc105fef79e2815327f681da6117f8254b00631d14f7a1634a65972b90ecfee6
De-pumped MD5 hash: a1fddc443d627b07ef25d89f6e0ca198
MIME type:application/x-dosexec
Signature PrivateLoader
Vendor Threat Intelligence
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a8fbdf962064abcda04658c707b65ae698e80d62d2d9d9eaeef3a36febf20c8c
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/a8fbdf962064abcda04658c707b65ae698e80d62d2d9d9eaeef3a36febf20c8c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8fbdf962064abcda04658c707b65ae698e80d62d2d9d9eaeef3a36febf20c8c/
Threat name:
Win32.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2024-05-01 17:45:08 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
10 of 38 (26.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vd557framsv43icglddqpns242moqdlc2lm5t2xo6orw727sbsga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a8fbdf962064abcda04658c707b65ae698e80d62d2d9d9eaeef3a36febf20c8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PK_PUMP_AND_DUMP
Create hunting rule
Author:Will Metcalf @node5
Description:Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PrivateLoader

zip a8fbdf962064abcda04658c707b65ae698e80d62d2d9d9eaeef3a36febf20c8c

(this sample)

  
Delivery method
Distributed via web download

Comments