MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8f7d01085c3695e7eef8462bf22fdd65aa0ca39d9f6ccd1d7f61ce09ac0401f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8f7d01085c3695e7eef8462bf22fdd65aa0ca39d9f6ccd1d7f61ce09ac0401f
SHA3-384 hash: 4d86610c18ae89cc84b86bef805c51f6e157b654c2279b2868184526a39b6dded5ead6f42b55bc620caab620d4b31f29
SHA1 hash: fa009ba870d9247a3afc98685346ee3b73d2431b
MD5 hash: 3fe0b63314fbd7c962e8d6a9a6d733df
humanhash: zebra-september-eight-table
File name:запусти меня.exe
Download: download sample
File size:446'464 bytes
First seen:2025-06-04 13:18:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a36817d78b68cd4fff8a5565537870bd
ssdeep 12288:7MSU4joci8M6PW1GVFeFd60DFUyhe9YM:ASUCpM2W1Gvgmye9v
TLSH T131947D27F6D08437D16336B9DC1B9698A929BD505D24244A3BF83E4C4F39383F92629F
TrID 69.1% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.3% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
0.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.4% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 4fc1c3ab8d99b5c5
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
422
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
запусти меня.exe
Verdict:
Malicious activity
Analysis date:
2025-06-04 13:59:33 UTC
Tags:
auto-reg delphi
Link:
https://app.any.run/tasks/a1ff5843-f2c8-418a-a044-f7116ba1ce7b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/7291/
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Win.Malware.Atus-9659809-0
Create hunting rule

Win.Trojan.Gimemo-820
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684049008bd5d68a12e52306
Tags:
lockscreen gimemo delphi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Searching for the window
Launching a process
Forced system process termination
Setting a single autorun event
Forced shutdown of a system process
Enabling autorun
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context borland_delphi explorer fingerprint keylogger lolbin packed runonce strictor
Link:
https://www.filescan.io/uploads/684047e1fd02ed5e0597d7c5/reports/44ee90fe-aa7e-41a5-a316-5922819d79d6/overview
Verdict:
Malicious
Labled as:
Ransom.Ryuk.Generic
Link:
https://www.hybrid-analysis.com/sample/b8f7d01085c3695e7eef8462bf22fdd65aa0ca39d9f6ccd1d7f61ce09ac0401f
Malware family:
Gimemo
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/98f7c327-a399-4ed8-9427-fe310a8a4a36
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1705952
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Creates an undocumented autostart registry key
Multi AV Scanner detection for submitted file
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Behaviour
Behavior Graph:
Download SVG
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b8f7d01085c3695e7eef8462bf22fdd65aa0ca39d9f6ccd1d7f61ce09ac0401f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8f7d01085c3695e7eef8462bf22fdd65aa0ca39d9f6ccd1d7f61ce09ac0401f/
Threat name:
Win32.Ransomware.Somhoveran
Create hunting rule
Status:
Malicious
First seen:
2025-06-03 22:49:21 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xd35aeefynuv47xpqrrl6ix52znkbsrz3h3mzuox6yoobgwaiapq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/250604-qj7j5ser31/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
System Location Discovery: System Language Discovery
Adds Run key to start application
Boot or Logon Autostart Execution: Active Setup
Modifies WinLogon for persistence
Verdict:
Malicious
Tags:
ransomware inlock Win.Malware.Atus-9659809-0
YARA:
WinLock
Link:
https://app.threat.zone/submission/3fcb2704-3708-4bd2-b7ee-c1483dd3681a
Unpacked files
SH256 hash:
b8f7d01085c3695e7eef8462bf22fdd65aa0ca39d9f6ccd1d7f61ce09ac0401f
MD5 hash:
3fe0b63314fbd7c962e8d6a9a6d733df
SHA1 hash:
fa009ba870d9247a3afc98685346ee3b73d2431b
Link:
https://www.unpac.me/results/5b9a93cd-abfc-4ea0-a9e2-e9b0a767060f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b8f7d01085c3695e7eef8462bf22fdd65aa0ca39d9f6ccd1d7f61ce09ac0401f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:WinLock
Create hunting rule
Author:@bartblaze
Description:Identifies WinLock (aka Blocker) ransomware variants generically.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b8f7d01085c3695e7eef8462bf22fdd65aa0ca39d9f6ccd1d7f61ce09ac0401f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3557721/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/7291/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA
WIN32_PROCESS_APICan Create Process and Threadsadvapi32.dll::OpenProcessToken
kernel32.dll::OpenProcess
kernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::TerminateProcess
kernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::GetWindowsDirectoryA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
advapi32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegCreateKeyExA
advapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
advapi32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments