MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9
SHA3-384 hash: f22d0e0d8a119980efa21b797890e5edad399d966db5561ea7701a30cbc6f5eac7c5f4a07de12c2f4c030e61153fac35
SHA1 hash: dd57cd19231fa739c72b64a82b79565a57012c13
MD5 hash: 6238844401f8aff02d953a77b401e4b5
humanhash: missouri-delta-music-nineteen
File name:file
Download: download sample
File size:4'248'272 bytes
First seen:2025-11-07 11:02:41 UTC
Last seen:2025-11-07 11:03:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 792d67354831cfbbfdde94753d96a116
ssdeep 49152:3zMByvUrn8JzFg2xG8jRsoWdr20DeC/HTg2mO1qkSKxqHD52MSgvz0qDS9bU82+w:ISxv48aa5KxqH/Sgww82+/kl
TLSH T15A167C596AEC00E5D4B6D03AC91B891BD7F27C421730479F02A0769BAF737A50E7E326
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543 signed

Code Signing Certificate

Organisation:Dongguan Yingping Technology Co., Ltd.
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2025-10-22T00:00:00Z
Valid to:2027-01-20T23:59:59Z
Serial number: 2d1dc3c2e0b0682ab3594e5237dd7c23
Cert Central Blocklist:This certificate is on the Cert Central blocklist
Thumbprint Algorithm:SHA256
Thumbprint: f90e60fe34fdf7559a53a7a68e9d9ffb839dd106083bce7ac1b2d3e206fa1034
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
Bitsight
url: http://178.16.54.200/files/7719064868/SJcGGrm.exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
87
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2025-11-07 11:06:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2b9cd709-c281-428c-b9e7-1b9129eb000a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/36438/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690dd1f630bacec888c9530f
Tags:
injection obfusc crypt
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto explorer fingerprint keylogger lolbin microsoft_visual_cc signed wmic
Link:
https://www.filescan.io/uploads/690dd1f8131554c23ed47e32/reports/7f9e37e2-69ed-4539-8402-ab3d806ac32c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9
Verdict:
Clean
File Type:
PE
First seen:
2025-11-07T09:11:00Z UTC
Last seen:
2025-11-08T10:28:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9/results?tab=lookup
Malware family:
LogMeIn
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1405f3a1-76e8-4820-aaa1-f8b79148c810
Score:
17%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xnbl3s7nh6afggceodhrz32roozz7oehnty3xi4vrwqhzec4nx4q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
credential_access discovery spyware stealer
Link:
https://tria.ge/reports/251107-m5s24acr91/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Browser Information Discovery
Enumerates physical storage devices
Reads user/profile data of web browsers
Enumerates connected drives
Credentials from Password Stores: Windows Credential Manager
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a427e778-952d-4425-8939-29afed0b1957
Unpacked files
SH256 hash:
bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9
MD5 hash:
6238844401f8aff02d953a77b401e4b5
SHA1 hash:
dd57cd19231fa739c72b64a82b79565a57012c13
Link:
https://www.unpac.me/results/5bb0e5ed-bdad-4d39-bad3-ff8bd2a427d0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.88
Link:
https://yomi.yoroi.company/submissions/bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe bb42bdcbed3f8053184470cf1cef5173b39fb8876cf1bba3958da07c905c6df9

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3698904/
Cape
Cape
https://www.capesandbox.com/analysis/36438/

Comments