MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 11 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40
SHA3-384 hash: e1a7c909bded3bf9a26c91093ab15546d17102a541c0af4d10960673b6a8b20877424dd3905f22a7d7ebf97e9a5152f9
SHA1 hash: b36e3e4eba279134bf11b90b62a2a2553b224720
MD5 hash: 8e4051967cb025af9468738605ee44d4
humanhash: comet-thirteen-beryllium-blue
File name:b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40.exe
Download: download sample
File size:3'674'624 bytes
First seen:2025-04-23 21:11:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bd5ec45a4dcc0883fc79c86573ac3684
ssdeep 49152:UJhubStUDYZZEWWq1bHDQHSuJcSQiOc6fYwh9U:Uucy1giKh9
TLSH T15806182B63A4936AC15EC13EC0B28F00E93371741B37CAD756B106695E4AAD49F3E7B1
TrID 63.4% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
0.1% (.VXD) VXD Driver (29/21)
Magika pebin
Reporter Rony
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
528
Origin country :
IN IN
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40
Verdict:
Malicious activity
Analysis date:
2025-04-23 19:34:36 UTC
Tags:
delphi
Link:
https://app.any.run/tasks/62eb2fd9-a0a7-4666-a1d2-8c8d95d16fe6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/3777/
Detection(s):
Win.Dropper.Tedy-10034813-0
Create hunting rule

Win.Loader.I2PRAT-10042650-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6809599b3d067f84839896a4
Tags:
virus shell micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching cmd.exe command interpreter
Creating a process with a hidden window
Connection attempt
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context embarcadero_delphi fingerprint keylogger packed
Link:
https://www.filescan.io/uploads/680957a4212716475fadda63/reports/71127aea-4181-488a-b380-c209c1448898/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a1325ba3-adee-4016-ab64-91e41b1cc3d1
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1672513
Signature
Adds a directory exclusion to Windows Defender
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1672513 Sample: loyBRRggDF.exe Startdate: 23/04/2025 Architecture: WINDOWS Score: 80 51 Malicious sample detected (through community Yara rule) 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 Yara detected UAC Bypass using CMSTP 2->55 57 2 other signatures 2->57 7 loyBRRggDF.exe 2->7         started        11 svchost.exe 1 1 2->11         started        13 loyBRRggDF.exe 2->13         started        15 loyBRRggDF.exe 2->15         started        process3 dnsIp4 45 195.2.75.24, 33334 VDSINA-ASRU Russian Federation 7->45 59 Adds a directory exclusion to Windows Defender 7->59 17 cmd.exe 1 7->17         started        20 cmd.exe 7->20         started        22 cmd.exe 7->22         started        24 58 other processes 7->24 47 127.0.0.1 unknown unknown 11->47 signatures5 process6 signatures7 49 Adds a directory exclusion to Windows Defender 17->49 26 powershell.exe 23 17->26         started        29 conhost.exe 17->29         started        31 powershell.exe 23 20->31         started        33 conhost.exe 20->33         started        35 powershell.exe 22->35         started        37 conhost.exe 22->37         started        39 powershell.exe 23 24->39         started        41 powershell.exe 24->41         started        43 112 other processes 24->43 process8 signatures9 61 Loading BitLocker PowerShell Module 31->61
Score:
83%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40/
Threat name:
Win64.Trojan.Nekark
Create hunting rule
Status:
Malicious
First seen:
2025-04-13 12:54:19 UTC
File Type:
PE+ (Exe)
Extracted files:
14
AV detection:
17 of 36 (47.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xackwcc7pt464vdnlbvtn256w47yoqqfxd5oasdwbxxhqn2535aa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/250423-z189qsvkw7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
Win.Dropper.Tedy-10034813-0
YARA:
n/a
Link:
https://app.threat.zone/submission/c240100d-ed5c-41e3-b7a6-06b83ce4acda
Unpacked files
SH256 hash:
b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40
MD5 hash:
8e4051967cb025af9468738605ee44d4
SHA1 hash:
b36e3e4eba279134bf11b90b62a2a2553b224720
Link:
https://www.unpac.me/results/cbcf28f1-3c7e-4f37-b2ce-0c461b9e0b1d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b804ab085f7cf9ee546d586b36ebbeb73f874205b8fae048760dee78375ddf40

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:crime_unidentified_118_packed
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects packed samples of malware family unidentified_118
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/3777/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediagdi32.dll::StretchDIBits
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExW
kernel32.dll::LoadLibraryA
kernel32.dll::LoadLibraryW
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoW
kernel32.dll::GetDiskFreeSpaceW
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileW
kernel32.dll::GetFileAttributesW
kernel32.dll::FindFirstFileW
version.dll::GetFileVersionInfoSizeW
version.dll::GetFileVersionInfoW
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegConnectRegistryW
advapi32.dll::RegCreateKeyExW
advapi32.dll::RegDeleteKeyW
advapi32.dll::RegLoadKeyW
advapi32.dll::RegOpenKeyExW
advapi32.dll::RegQueryInfoKeyW
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::EmptyClipboard
user32.dll::FindWindowExW
user32.dll::FindWindowW
user32.dll::OpenClipboard

Comments


Avatar
commented on 2025-04-30 08:48:45 UTC

https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_121