MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c68bffb8c177ade24a91666c3103e6c19097890abc558233ba0eb4f745f41e96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 23 File information Comments

SHA256 hash:	c68bffb8c177ade24a91666c3103e6c19097890abc558233ba0eb4f745f41e96
SHA3-384 hash:	887f48a0e1e7c9bbb5161d7207138d7591d59b3ab259d034607efcc2fa2d56e3847457abbb2d5e8b43f965987cfdd5f7
SHA1 hash:	002f2b53d39231e29989427de7730220fb1d3adf
MD5 hash:	e421ad53b169282b04e50e1b9d1faa9e
humanhash:	whiskey-shade-tennis-solar
File name:	403404323857317050-pdf.zip
Download:	download sample
File size:	8'144'466 bytes
First seen:	2026-08-21 08:02:58 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:9XujXRJEVCeRxXLetCW71UHuodO8FI7eWKtqh:9+LPE7XLeL+O8FIUtO
TLSH	T1318633C46B7AE640CA0740AD4AEC10EC56C48F4ACA5565AF79ECB26D680F4EF9DDCD08
Magika	zip
Reporter	marsomx
Tags:	Babadeda ClickFix CNCMachineRMS Loader RAT SmartApeSG zip

marsomx_

CNCMachineRMS/BabaDeda RAT configuration extracted:
{
"campaign": "first",
"lsdb_save_path": "{localappdata}\\\\RTProject\\\\rtc.bin",
"lsdb_save_delay_seconds": 200,
"is_marketing_notify": false,
"is_tosend_firstlaunch_screenshot": true,
"enable_acs_onstart": true,
"gate_connect_period_seconds": 600,
"gate_connected_duration_seconds": 90,
"gate_failed_reconnect_delay_seconds": 60,
"gate_keep_alive_duration_seconds": 90,
"gate_list": [
[
"triotmelon[.]com",
"443"
],
[
"144.124.242[.]171",
"443"
]
],
"is_vmcheck": true,
"vmdetect_sleep_seconds": 660
}

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 21 file(s), sorted by their relevance:

File name:	vcruntime140_1.dll
File size:	47'264 bytes
SHA256 hash:	e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 hash:	03b43160d21c08de07a79d0a1c5ee81d
MIME type:	application/x-dosexec

File name:	libstdc++-6.dll
File size:	2'463'194 bytes
SHA256 hash:	ffdee6daaa4afc1975a4ec0371161078a864c6c1f27186b93a673801cad99eba
MD5 hash:	444c1509eb2e1dfa3e23a4f92cc97b31
MIME type:	application/x-dosexec

File name:	SDL3.dll
File size:	2'800'128 bytes
SHA256 hash:	132e7f953951944f7628861227ecaea8c37a5a484f004c2072b7f3a1c343fa73
MD5 hash:	53bf4991a5e4e64ddd6605327a5ef027
MIME type:	application/x-dosexec

File name:	libgcc_s_seh-1.dll
File size:	151'364 bytes
SHA256 hash:	729214efc075b7d4a6fd6309d13f8c49574f3d30c60cf0fb6fc002d90a265866
MD5 hash:	34883f52673bded72f9aa7492476dfed
MIME type:	application/x-dosexec

File name:	msvcp140_2.dll
File size:	268'912 bytes
SHA256 hash:	fbb8557f73ab9a207bd67643fdcf9ae34527325d227c53707cebdf0d1c8c4658
MD5 hash:	f7b44650da2eb3b80cdda2ac699f4a0f
MIME type:	application/x-dosexec

File name:	wwide9.dll
File size:	96'424 bytes
SHA256 hash:	e50d9b4dc4db137c1aa6c48f801785e0300fc1091c61ca9385e8116cdca88768
MD5 hash:	40449e3b37fb325f1fc21d13665ef357
MIME type:	application/x-dosexec

File name:	Graphic.Model.dat
File size:	1'013'891 bytes
SHA256 hash:	6b1dfa9381c54782da709478c2f343b2988f089da449f0bd79fd732265f4e6d7
MD5 hash:	e54f428d7a0c824d4c8797716d305ea0
MIME type:	application/octet-stream

File name:	HTS25.dll
File size:	97'792 bytes
SHA256 hash:	32797a560b9a290e715cb5591e71dd9537d782862324906e1bb4652dd2366c9a
MD5 hash:	18a77c124873581799cc69ab17611c85
MIME type:	application/x-dosexec

File name:	msvcp140_1.dll
File size:	35'976 bytes
SHA256 hash:	ba0cd05bef6aa5f54f8e86a175742020a98e35a6df116402e5e31ff9e0e8d72b
MD5 hash:	d508b529bbb3849032c7b3d41cb01360
MIME type:	application/x-dosexec

File name:	wwb9_64.dll
File size:	3'163'264 bytes
SHA256 hash:	671ba5caae316b8abe01e4961eb48c9f5e4eac5a957619b30c18fc3d2f72966c
MD5 hash:	99b80a1ee18e33af9825b873537278a8
MIME type:	application/x-dosexec

File name:	load.db
File size:	1'690'488 bytes
SHA256 hash:	9a7ec20cfe939a0739819262c1e3ff0265c851136cc263597936773376a5d907
MD5 hash:	7d76403e6ac97f92b2897c1f91b509d4
MIME type:	application/octet-stream

File name:	usbraw.dll
File size:	103'936 bytes
SHA256 hash:	d4df2adf41455644e8df22db1f410a46d2d069cdcc6373aac0742d65c34c2186
MD5 hash:	e8a5b7fb6a9c5b68ed531edd94366cad
MIME type:	application/x-dosexec

File name:	vcruntime140.dll
File size:	123'472 bytes
SHA256 hash:	184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 hash:	0d35c5e99871b4f02c490b9fd9dace34
MIME type:	application/x-dosexec

File name:	PkSql1.dll
File size:	120'832 bytes
SHA256 hash:	d7bcae4a915261ace7a845f8c1bb2a54ce918921805204125705bfae29656851
MD5 hash:	bac4aa795cbcbaa29bc7630730d3f903
MIME type:	application/x-dosexec

File name:	WinWrapIDE.exe
File size:	313'512 bytes
SHA256 hash:	0562c588997fa9961d55c6ab1db2656344324bca8db9ea7b64fe309132b2399f
MD5 hash:	bfb25270df49bb391193a59281d5ffcf
MIME type:	application/x-dosexec

File name:	ucrtbase.dll
File size:	997'056 bytes
SHA256 hash:	4c5b8e529854cedfa8f46cd6906952400cdbbf25efc4cf37dda2c42d8e96ddcb
MD5 hash:	ed82e9c6c4f7a475d7fd6ebabf3fab2a
MIME type:	application/x-dosexec

File name:	concrt140.dll
File size:	344'712 bytes
SHA256 hash:	8032b43bdd2f18ce7eb131e7cd542967081bea9490df08681bf805ce4f4d3aab
MD5 hash:	65f2e5a61f39996c4df8ae70723ab1f7
MIME type:	application/x-dosexec

File name:	libwinpthread-1.dll
File size:	63'678 bytes
SHA256 hash:	04737a97282e4068a06ebce60ef80d2f42b8dd33ed7f2cf09ee85d4167e6f9a1
MD5 hash:	3134477e8dd41782ef0406d2b71361d3
MIME type:	application/x-dosexec

File name:	msvcp140.dll
File size:	553'552 bytes
SHA256 hash:	def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 hash:	4e3fa9bd90ef020c14359639dc19312b
MIME type:	application/x-dosexec

File name:	mfc140u.dll
File size:	5'651'104 bytes
SHA256 hash:	fc9b1f94752d7080436824b480e83ba1ec930e3f7baa881f4e842b882e715cfc
MD5 hash:	90bd2d218dbd4a5532ab13dfe2a43839
MIME type:	application/x-dosexec

File name:	wwb9$000.dll
File size:	69'248 bytes
SHA256 hash:	1339e336618f8d2d396100b8d6275d497e9ba0b59cec922d9ddeaf8cae08da72
MD5 hash:	59ea8861093fce5bcd65371e9ffb502c
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d4a4172b-0294-45a7-9ecc-c3add6772e31/

Detection(s):

SecuriteInfo.com.Heur.23123.27272.UNOFFICIAL

YARA.MALPEDIA_Win_Bqtlock_Auto.UNOFFICIAL

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c68bffb8c177ade24a91666c3103e6c19097890abc558233ba0eb4f745f41e96

Score:

20%

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/260821-jzhgmaaq9y/

Behaviour

Suspicious use of SetWindowsHookEx

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c68bffb8c177ade24a91666c3103e6c19097890abc558233ba0eb4f745f41e96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	attack_India Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	Glasses Create hunting rule
Author:	Seth Hardy
Description:	Glasses family

Rule name:	GlassesCode Create hunting rule
Author:	Seth Hardy
Description:	Glasses code features

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETDLLMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	win_bqtlock_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.bqtlock.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip c68bffb8c177ade24a91666c3103e6c19097890abc558233ba0eb4f745f41e96

(this sample)

Link

https://www.malware-traffic-analysis.net/2026/08/12/index.html

Link

https://marsomx.github.io/posts/babadeda-malware-analysis/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample