MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb723217f9c2932116c9e1313d558a7baddb921886eaa3beca95f7b3c5b848b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 10 File information Comments

SHA256 hash:	bb723217f9c2932116c9e1313d558a7baddb921886eaa3beca95f7b3c5b848b0
SHA3-384 hash:	48b95bc8ca7b6944fdfbb266570f448775ff0703898273c18c5171a21229f221a02c8928efbfab0b34408f98d527d79d
SHA1 hash:	11a17eb742d6a12aee7d8c5f4b56e8f3b316dcac
MD5 hash:	1de5029faf42841f563d79f72d27c3de
humanhash:	ink-music-mississippi-north
File name:	ClassLibrary4.dll
Download:	download sample
File size:	2'002'944 bytes
First seen:	2025-09-18 06:54:47 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep	49152:wQEU4fGSUIP78V0kUw0LwjfQYt3ODsbm8xio/TsdtU5o7CvTPZMqDLZrt0fFKMWx:wQEU4fGSUIP7U0kUw0LwjfQYt3ODsbmi
TLSH	T1B595C727B3967B72C1540732C296242E8755D2CE2B63FB0A3D97072E19CA7FE9C4584B
TrID	82.1% (.DLL) Generic .NET DLL/Assembly (236632/4/32) 5.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.6% (.EXE) Win64 Executable (generic) (10522/11/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	0xb0mb3r
Tags:	dll PureLogs stealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/28089/

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68cbad0124320325464764ea

Tags:

shellcode injection emotet obfusc

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 net_reactor obfuscated obfuscated overlay packed reconnaissance

Link:

https://www.filescan.io/uploads/68cbad48c62f6996238b05fe/reports/9c7b7e32-9e42-4d7a-ba12-aa54b304a0e9/overview

Verdict:

Malicious

Labled as:

Tedy.Generic

Link:

https://www.hybrid-analysis.com/sample/bb723217f9c2932116c9e1313d558a7baddb921886eaa3beca95f7b3c5b848b0

Verdict:

Malicious

File Type:

executable.pe.32.dll

First seen:

2025-09-18T04:49:00Z UTC

Last seen:

2025-09-18T04:49:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bb723217f9c2932116c9e1313d558a7baddb921886eaa3beca95f7b3c5b848b0/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e841d36f-c852-42e3-9b3b-23e5ba3e1711

Score:

96%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bb723217f9c2932116c9e1313d558a7baddb921886eaa3beca95f7b3c5b848b0

Verdict:

Malware

YARA:

12 match(es)

Tags:

.Net .Net Obfuscator .Net Reactor Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.71 Win 32 Exe x86

Link:

https://app.malva.re/file/1de5029faf42841f563d79f72d27c3de

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb723217f9c2932116c9e1313d558a7baddb921886eaa3beca95f7b3c5b848b0/

Threat name:

ByteCode-MSIL.Trojan.Malgent

Status:

Malicious

First seen:

2025-09-18 06:59:40 UTC

File Type:

PE (.Net Dll)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xnzdef7zykjscfwj4eyt2vmkpow5xeqyq3vkhpwksx33hrnyjcya._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250918-hqj4essshy/

Unpacked files

SH256 hash:

bb723217f9c2932116c9e1313d558a7baddb921886eaa3beca95f7b3c5b848b0

MD5 hash:

1de5029faf42841f563d79f72d27c3de

SHA1 hash:

11a17eb742d6a12aee7d8c5f4b56e8f3b316dcac

Link:

https://www.unpac.me/results/21aacf1d-fe9e-4655-a541-68b36ac79f10/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.56

Link:

https://yomi.yoroi.company/submissions/bb723217f9c2932116c9e1313d558a7baddb921886eaa3beca95f7b3c5b848b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	TH_Generic_MassHunt_Webshells_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic multi-language webshell mass-hunt rule (PHP/ASP(X)/JSP/Python/Perl/Node) - 2025
Reference:	https://cyfare.net/