MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b
SHA3-384 hash: e399d445b7f181469d19dee931f896f63ae3880558e77422f6ebf107c48be7799bb49b19a95d82a2853142f1ebcb9f4c
SHA1 hash: b01ef26c1ae56602e60e8e4469e0030651fb1e46
MD5 hash: c7082bdd27233200550c3a6dcd4161e6
humanhash: failed-magazine-alabama-equal
File name:b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b
Download: download sample
File size:93'712 bytes
First seen:2025-12-30 12:16:36 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 4a39d28037d506187d6d7a524b7ad305
ssdeep 1536:RvXkW7KvLROr8GwME8cabAsWp5NnSQM/Xb0Ce7vzgbksWKQcdw+ZN3S8QVOS8t/A:RhsLdtM3AsISQM/XSzKrwSRS8QVO5G
TLSH T1AD937B1075D2C075E5BE29361838DA755B3D7990DFE09DEB23850ABE4F302C1EE35A2A
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter JAMESWT_WT
Tags:APT-Q-27 dll signed

Code Signing Certificate

Organisation:Shandong Saibo Information Technology Co., Ltd.
Issuer:Certum Extended Validation Code Signing 2021 CA
Algorithm:sha256WithRSAEncryption
Valid from:2025-11-18T13:58:52Z
Valid to:2026-11-18T13:58:51Z
Serial number: 5be7b13f587b8850573257df55e5e39e
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: a8aaa6984ac9c8537e36dd77b4b121855c3d1828335246fa62f44b3428c7dbfb
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46559/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6953c2cc7d915bf1778f008e
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
microsoft_visual_cc revoked-cert signed
Link:
https://www.filescan.io/uploads/6953c2ca148c21e830ee835a/reports/2e69258a-50ba-4022-8826-0cbe535c8742/overview
Verdict:
Malicious
Labled as:
Trojan_Win32_Loader_quu
Link:
https://www.hybrid-analysis.com/sample/b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b
Verdict:
Malicious
File Type:
dll x32
First seen:
2025-11-30T20:10:00Z UTC
Last seen:
2025-12-08T03:49:00Z UTC
Hits:
~100
Detections:
VHO:Trojan.Win32.Loader.gen VHO:Trojan.Win32.Loader.quu Trojan.Win32.Loader.quu
Link:
https://opentip.kaspersky.com/b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/53a9db8b-f514-4397-85ed-908c60daffc6
Score:
84%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/c7082bdd27233200550c3a6dcd4161e6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b/
Verdict:
Malicious
Threat:
VHO:Trojan.Win32.Loader
Link:
https://tip.neiki.dev/file/b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2025-12-01 01:09:30 UTC
File Type:
PE (Dll)
AV detection:
7 of 36 (19.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgmgc3zq5rw564mwr6krgkjht4fjce7rofh5bfv5luephyomnunq._file
Gathering data
Unpacked files
SH256 hash:
b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b
MD5 hash:
c7082bdd27233200550c3a6dcd4161e6
SHA1 hash:
b01ef26c1ae56602e60e8e4469e0030651fb1e46
Link:
https://www.unpac.me/results/d055caa3-feef-45ac-8668-bc0aea25d100/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b998616f30ec6ddf71968f951329279f0a9113f1714fd096bd5d08f3e1cc6d1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/46559/

Comments