MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8d6799f802cb02c3b7b78bf32cf95dba67bfd21cbcd13491bec6ea1fdfc473b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c8d6799f802cb02c3b7b78bf32cf95dba67bfd21cbcd13491bec6ea1fdfc473b
SHA3-384 hash:	b791c538e5ef6103d9910785bbba284084d7b12143fa9ed8006e152a9d3ef3918080d0c15db02b0959bfd1d6d74f60d8
SHA1 hash:	2dec4d53953567d8b9a2d66e2ef709bdf6501bd8
MD5 hash:	bb5b1be866137ac79583ebb2f9ed754f
humanhash:	six-don-high-finch
File name:	installer-x64.zip
Download:	download sample
Signature	YellowCockatoo Alert Create hunting rule
File size:	2'643'939 bytes
First seen:	2024-05-21 16:21:42 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:wGtxV2zEU7s+h0Coc7hzxNCkxvKd4ZmoFWphc5:Hap7scNR3NCklKd4cIWc5
TLSH	T1F3C544BA2D8770ABA1EB3EE32858D4BB01B7993CF9CD1E88107551C9D6191FBF12146C
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	SquiblydooBlog
Tags:	file-pumped Jupyter Polazert solarmarker YellowCockatoo zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

375

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	installer-x64.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	320'250'912 bytes
SHA256 hash:	9fcdb329122b918110be82e8040386798f1a0c28ad1d103bf06e5df6ec820aca
MD5 hash:	8ac77f704640fa1c8feb9172302bf313
De-pumped file size:	320'246'272 bytes (Vs. original size of 320'250'912 bytes)
De-pumped SHA256 hash:	4fe7de6e5a6633c99ae73eec1ef136a90e3f055ceb479e06430aef34cc960d13
De-pumped MD5 hash:	add5bfcdcb589e56e2d5474d62b9cd0d
MIME type:	application/x-dosexec
Signature	YellowCockatoo

Vendor Threat Intelligence

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/c8d6799f802cb02c3b7b78bf32cf95dba67bfd21cbcd13491bec6ea1fdfc473b/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c8d6799f802cb02c3b7b78bf32cf95dba67bfd21cbcd13491bec6ea1fdfc473b

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/c8d6799f802cb02c3b7b78bf32cf95dba67bfd21cbcd13491bec6ea1fdfc473b

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/c8d6799f802cb02c3b7b78bf32cf95dba67bfd21cbcd13491bec6ea1fdfc473b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c8d6799f802cb02c3b7b78bf32cf95dba67bfd21cbcd13491bec6ea1fdfc473b/

ReversingLabs TitaniumCloud Binary.Trojan.Hulk

Threat name:

Binary.Trojan.Hulk

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-05-21 16:22:08 UTC

File Type:

Binary (Archive)

Extracted files:

14

AV detection:

6 of 38 (15.79%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zdlhth4afsycyo33pc7tft4v3othx7jbzpgrgsi35rxkd7p4i45q._file

Hatching Triage jupyter

Result

Malware family:

jupyter

Alert

Create hunting rule

Score:

  10/10

Tags:

family:jupyter backdoor stealer trojan

Link:

https://tria.ge/reports/240521-vf9ybacd6z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Jupyter, SolarMarker

Malware Config

C2 Extraction:

2.58.15.118

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c8d6799f802cb02c3b7b78bf32cf95dba67bfd21cbcd13491bec6ea1fdfc473b