MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OctoRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2
SHA3-384 hash: 739a80b22afcccf705ec5fa00b3210b2216fe1dfe72305bcfa75d7e92b921c7b2a7bf80929bcf5f0ceaf48b6695acf3e
SHA1 hash: 1e6fb29143f1d27dd1f750adda38bb9f6cef7301
MD5 hash: 69905105c88d17248aa705855c89c6c6
humanhash: freddie-winter-earth-hotel
File name:b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2
Download: download sample
Signature OctoRAT
Create hunting rule
File size:240'640 bytes
First seen:2025-12-04 07:55:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 6144:XKZ2rzyd3lb5MrlJv0/a9M2sCQYl6Wc5QX:aZ2rg3grl1V9MpCQOTs
TLSH T10A342349AEDC91B1CEE91FBEC8BB08B14294CE6C06DD9194EF21E1157F413E4990DA3E
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter JAMESWT_WT
Tags:exe OctoRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2.exe
Verdict:
No threats detected
Analysis date:
2025-12-04 08:18:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/35deb570-46ad-4a1c-8147-75657075d7a3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42453/
Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69313ea6264b106bd646de38
Tags:
virus micro msil
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin packed reconnaissance vbc
Link:
https://www.filescan.io/uploads/69313ea1ff25e40750d31757/reports/e8683dec-a230-47b3-a7ee-b0389f0c4f7a/overview
Verdict:
Malicious
Labled as:
MSIL/Injector_AGeneric.LQ trojan
Link:
https://www.hybrid-analysis.com/sample/b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-21T15:07:00Z UTC
Last seen:
2025-12-04T13:09:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Stealer.sb HEUR:Trojan-PSW.MSIL.Coins.gen
Link:
https://opentip.kaspersky.com/b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2d1e961c-f0ae-4d63-8455-afefac51757a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.29 Win 32 Exe x86
Link:
https://app.malva.re/file/69905105c88d17248aa705855c89c6c6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2/
Verdict:
Malicious
Threat:
Trojan-PSW.MSIL.Coins
Link:
https://tip.neiki.dev/file/b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2
Threat name:
ByteCode-MSIL.Trojan.Coins
Create hunting rule
Status:
Malicious
First seen:
2025-11-21 22:41:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xc6evhe43bu3agdkcr347svuk5w7v62ytfjqrqpjpgwtzqammdza._file
Verdict:
malicious
Label(s):
anivialoader
Create hunting rule
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/251204-jstlbacv7e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Uses the VBS compiler for execution
Verdict:
Malicious
Tags:
External_IP_Lookup
YARA:
n/a
Link:
https://app.threat.zone/submission/876d30e3-9fd2-4041-a27c-7c7c6aaf0f3d
Unpacked files
SH256 hash:
b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2
MD5 hash:
69905105c88d17248aa705855c89c6c6
SHA1 hash:
1e6fb29143f1d27dd1f750adda38bb9f6cef7301
Link:
https://www.unpac.me/results/520b142d-3854-451a-b7f5-f0539552e361/
SH256 hash:
3c51e953e7fe439b0a1e6153ccaa4db91c0d448f4356184d8a38559afbeae6cb
MD5 hash:
0a4696b0108833a20f1a964c4a21cdbe
SHA1 hash:
dc7bc9dad8aa6c6ae56fedb9faacf1e1747f4737
Detections:
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Link:
https://www.unpac.me/results/520b142d-3854-451a-b7f5-f0539552e361/
SH256 hash:
35c5a43acaa0666b0ffcc53b245555eaceb7851db8c6238057cd016f0a675ffb
MD5 hash:
c66d70b898091ad347d78d714e93fa35
SHA1 hash:
45bada9f7a9060585389b8de8d146d3d847547f3
Detections:
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Link:
https://www.unpac.me/results/520b142d-3854-451a-b7f5-f0539552e361/
SH256 hash:
360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f
MD5 hash:
9a5ff998dbf0f6923d0b454d89800fb4
SHA1 hash:
4f4fa23e9c503b941a5e91584d6ecc3813962ba1
Detections:
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Link:
https://www.unpac.me/results/520b142d-3854-451a-b7f5-f0539552e361/
Parent samples :
b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2
360e6f2288b6c8364159e80330b9af83f2d561929d206bc1e1e5f1585432b28f
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b8bc4a9c9cd8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b8bc4a9c9cd869b0186a1477cfcab4576dfafb58995308c1e979ad3cc00c60f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/42453/

Comments