MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3cb53c4a290bc9ab6c9eb825ed0ca38bb54bcc4a59f33be72becdff80cb091b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lazarus


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3cb53c4a290bc9ab6c9eb825ed0ca38bb54bcc4a59f33be72becdff80cb091b
SHA3-384 hash: 7f962617c05b6d10592684127a45a326a735c74f8a7f90adc94ecd9dd69cfca27854e64e0e9dfd9f2d5b64608b068a0f
SHA1 hash: 64fb3eab9bc4d11c39c78003446b7c3897af62f0
MD5 hash: bc04dfaa0f97bc05bf9ae28b0cf9d9e5
humanhash: minnesota-jig-cardinal-oregon
File name:brow8_84.py
Download: download sample
Signature Lazarus
Create hunting rule
File size:258'079 bytes
First seen:2025-05-23 21:16:33 UTC
Last seen:Never
File type:
MIME type:text/plain
ssdeep 6144:cLDxET6hypGAPbrDRwggzvpmJqkJE71DvqOKNwSiKGq:cLlAP3DCzRmEkmlNKNvQq
TLSH T1704412B28EB817BAD48C8974541FF48D4E943760885933DB42A62F65DB7E3F401AFE60
Magika txt
Reporter skocherhan
Tags:144-172-95-226 Lazarus py


Avatar
skocherhan
http://144.172.95.226:1224/brow/8/84

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
GB GB
Vendor Threat Intelligence
Detection(s):
Py.Packer.FreeCodingTools-10037449-0
Create hunting rule

Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6830edac44c3881e854c8c5c
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6830e5e6fd02ed5e0585683b/reports/b6b391b8-5fdb-440c-b539-7d29c9c799cb/overview
Verdict:
Malicious
Labled as:
Py.Packer.FreeCodingTools
Link:
https://www.hybrid-analysis.com/sample/c3cb53c4a290bc9ab6c9eb825ed0ca38bb54bcc4a59f33be72becdff80cb091b
Score:
93%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c3cb53c4a290bc9ab6c9eb825ed0ca38bb54bcc4a59f33be72becdff80cb091b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3cb53c4a290bc9ab6c9eb825ed0ca38bb54bcc4a59f33be72becdff80cb091b/
Threat name:
Win32.Trojan.SuspExecRep
Create hunting rule
Status:
Malicious
First seen:
2025-05-21 18:25:51 UTC
File Type:
Text (Python)
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ypfvhrfcsc6jvnwj5obf5ugkhc5vjpgeuwpthptsx3g77aglbenq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250523-z47kbaaq5w/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lazarus
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3cb53c4a290bc9ab6c9eb825ed0ca38bb54bcc4a59f33be72becdff80cb091b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments