🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbf1cd9f0d440e454b8baf96f5de39ad34e9e7a73351d8cb8d5892c731bd3977. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbf1cd9f0d440e454b8baf96f5de39ad34e9e7a73351d8cb8d5892c731bd3977
SHA3-384 hash: 247892c39efde1b8c883da304a4904a660382d12a7a281ed39d837fb9dbabac03097b43a2f101ba51ad6d68ff17cbcf3
SHA1 hash: 99c9c489046f5b8e05da27676a0ed8a1bdfb8492
MD5 hash: 3353527f3c05235a7e35d9d9d591d900
humanhash: bravo-fish-vermont-fanta
File name:classcomputer.zip
Download: download sample
File size:1'953'580 bytes
First seen:2025-04-03 14:26:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:DgBGhV94bKqt0mcGWkaeK87codB3OPzf3b+EJefP4A7g3nl:Dgo/SdxWLelcodBszf3JeHn7g3l
TLSH T1729533EC6124792DFE8AF52D714512CEA577142DB436F10EA8FB039724C3A71B928B4B
Magika zip
Reporter JAMESWT_WT
Tags:195-82-147-81 zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
14
Origin country :
IT IT
File Archive Information

This file archive contains 18 file(s), sorted by their relevance:

File name:MSVCP140.dll
File size:2'618'368 bytes
SHA256 hash: 6ba895d720c8e91d1d72869e2f5f135b4641cf4279a19b7134efe16ec7adf90a
MD5 hash: 4935851f47a918dc90bdefe65596dc6b
MIME type:application/x-dosexec
File name:zCrashReport64.dll
File size:402'192 bytes
SHA256 hash: 3ce715d818b18dba4a82ecb4c32a7bcbbb2d7b1708c7c642aa057c85fb202be5
MD5 hash: 3968dce4f56ae84549f5e657bc015c78
MIME type:application/x-dosexec
File name:api-ms-win-crt-utility-l1-1-0.dll
File size:12'224 bytes
SHA256 hash: c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
MD5 hash: 6f1a1dfb2761228ccc7d07b8b190054c
MIME type:application/x-dosexec
File name:api-ms-win-crt-heap-l1-1-0.dll
File size:12'744 bytes
SHA256 hash: 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
MD5 hash: 212d58cefb2347bd694b214a27828c83
MIME type:application/x-dosexec
File name:api-ms-win-crt-string-l1-1-0.dll
File size:18'368 bytes
SHA256 hash: 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
MD5 hash: f816666e3fc087cd24828943cb15f260
MIME type:application/x-dosexec
File name:VCRUNTIME140.dll
File size:94'088 bytes
SHA256 hash: 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
MD5 hash: 7942be5474a095f673582997ae3054f1
MIME type:application/x-dosexec
File name:api-ms-win-crt-math-l1-1-0.dll
File size:20'928 bytes
SHA256 hash: f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
MD5 hash: fb79420ec05aa715fe76d9b89111f3e2
MIME type:application/x-dosexec
File name:VCRUNTIME140_1.dll
File size:36'744 bytes
SHA256 hash: f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44
MD5 hash: ab03551e4ef279abed2d8c4b25f35bb8
MIME type:application/x-dosexec
File name:api-ms-win-crt-filesystem-l1-1-0.dll
File size:13'768 bytes
SHA256 hash: 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
MD5 hash: 41fbbb054af69f0141e8fc7480d7f122
MIME type:application/x-dosexec
File name:api-ms-win-crt-stdio-l1-1-0.dll
File size:17'864 bytes
SHA256 hash: 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
MD5 hash: 29680d7b1105171116a137450c8bb452
MIME type:application/x-dosexec
File name:api-ms-win-crt-time-l1-1-0.dll
File size:14'280 bytes
SHA256 hash: b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
MD5 hash: 143a735134cd8c889ec7d7b85298705b
MIME type:application/x-dosexec
File name:api-ms-win-crt-runtime-l1-1-0.dll
File size:16'328 bytes
SHA256 hash: 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
MD5 hash: 883120f9c25633b6c688577d024efd12
MIME type:application/x-dosexec
File name:api-ms-win-crt-convert-l1-1-0.dll
File size:15'816 bytes
SHA256 hash: 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
MD5 hash: 285dcd72d73559678cfd3ed39f81ddad
MIME type:application/x-dosexec
File name:nasrallah_x86.dll
File size:19'469 bytes
SHA256 hash: 8f2be38dfedbe1cf575592a76179017e82b56d1da1f1c5fa551fb7ea9549bfee
MD5 hash: f37ffd0289309493a1e2c3d406f3af67
MIME type:application/octet-stream
File name:classcomputer.exe
File size:1'162'512 bytes
SHA256 hash: eb1b7b9339b349202ce8498202b995c61ffd1ba322a3ac4aa8b7b67fb666da16
MD5 hash: 3e1f7529ae3a5534cfaec4a3aa8bb750
MIME type:application/x-dosexec
File name:api-ms-win-crt-locale-l1-1-0.dll
File size:12'232 bytes
SHA256 hash: edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
MD5 hash: 242829c7be4190564becee51c7a43a7e
MIME type:application/x-dosexec
File name:api-ms-win-crt-environment-l1-1-0.dll
File size:12'232 bytes
SHA256 hash: aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
MD5 hash: 5cce7a5ed4c2ebaf9243b324f6618c0e
MIME type:application/x-dosexec
File name:_RDATA
File size:512 bytes
SHA256 hash: e2f1605fe0fbf88bc17b63968ef0e83804a14aa3193ad2495b596c636eaed1e0
MD5 hash: 87949c8e5856de2b7496ae1375de36d4
MIME type:application/octet-stream
Vendor Threat Intelligence
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ee9de9855e5ec5240d0216
Tags:
injection vmdetect obfusc crypt
Verdict:
Unknown
Threat level:
n/a  -.1/10
Confidence:
100%
Tags:
expired-cert microsoft_visual_cc packed signed
Link:
https://www.filescan.io/uploads/67ee9ac140adfb5162b81f53/reports/24387a9d-c2c4-4da2-a6b3-d4a0dc5d732d/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/bbf1cd9f0d440e454b8baf96f5de39ad34e9e7a73351d8cb8d5892c731bd3977
Score:
97%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/bbf1cd9f0d440e454b8baf96f5de39ad34e9e7a73351d8cb8d5892c731bd3977
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bbf1cd9f0d440e454b8baf96f5de39ad34e9e7a73351d8cb8d5892c731bd3977/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-02 12:43:50 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xpy43hyniqheks4lv6lplxrzvu2otz5hgni5rs4nlcjmomn5hf3q._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250403-scvywax1dx/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Malware Config
Dropper Extraction:
https://app-updater1.app/api/getFile?fn=ch_ch.hta
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bbf1cd9f0d440e454b8baf96f5de39ad34e9e7a73351d8cb8d5892c731bd3977

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip bbf1cd9f0d440e454b8baf96f5de39ad34e9e7a73351d8cb8d5892c731bd3977

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3500173/
  
Delivery method
Distributed via web download

Comments