MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c1b5dd79430f003d43d6c738e18ef5d3c6ad46e6cba685df5a0b6bc526d0f697. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | c1b5dd79430f003d43d6c738e18ef5d3c6ad46e6cba685df5a0b6bc526d0f697 |
|---|---|
| SHA3-384 hash: | 87f60a97e3b9bd79f247a8437ef2e25d1de465331ef3c68a6875863e68bacdf05d8df6bf677a9e19c392c8e39dc91fee |
| SHA1 hash: | 2ecc68fa8a325866dceaba51e941d9ab077c5d8b |
| MD5 hash: | 78c7a6d05f1147b4dfcd40b6ce5fe405 |
| humanhash: | october-cat-yankee-item |
| File name: | 78c7a6d05f1147b4dfcd40b6ce5fe405.exe |
| Download: | download sample |
| File size: | 6'552'185 bytes |
| First seen: | 2022-03-25 18:19:25 UTC |
| Last seen: | 2024-07-24 21:10:04 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat) |
| ssdeep | 98304:h76HYGHUKMWIOZLNP009qjP+WgbpU09/PMKjoHDzQ8AAW1llu4BD:J8dUAOFyJ9PM0oHDzK91llhD |
| Threatray | 1'587 similar samples on MalwareBazaar |
| TLSH | T105663303F68D97BEEA265E707574923029689F231B358B5B73D0DD7E8A7105CA930BC2 |
| File icon (PE): |  |
| dhash icon | 6ccccc9cc4dce8f4 (4 x Formbook, 3 x Smoke Loader, 3 x AsyncRAT) |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll update.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Signature
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2022-03-25 09:48:23 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
11 of 26 (42.31%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 1'577 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Unpacked files
SH256 hash:
9687fc60f2e9c155d4302762f19cf9fb62aed5a16276e20f7e38f9f7fd3efc48
MD5 hash:
c1969646c91686ca0abce360c9bd1174
SHA1 hash:
f1e8ceb44b51efe6fd2d404cabcc94b2c9500e9a
SH256 hash:
c1b5dd79430f003d43d6c738e18ef5d3c6ad46e6cba685df5a0b6bc526d0f697
MD5 hash:
78c7a6d05f1147b4dfcd40b6ce5fe405
SHA1 hash:
2ecc68fa8a325866dceaba51e941d9ab077c5d8b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe c1b5dd79430f003d43d6c738e18ef5d3c6ad46e6cba685df5a0b6bc526d0f697
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.