MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc70a61a7972a8a29fb6fa6123793f48ad14250e53128cd61228fdd848b86018. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ResolverRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc70a61a7972a8a29fb6fa6123793f48ad14250e53128cd61228fdd848b86018
SHA3-384 hash: 6eaebcaa3c2937a09a02d9d458c00d93c52b938a0837ef336c88988ee2fa4f0682db3f8fba4ebc05a65b24bd96bd058e
SHA1 hash: ae776456d15ad624a23a409a22804bbfc059926b
MD5 hash: bcff15ba13367530dcce427ad2613d69
humanhash: alabama-november-michigan-nebraska
File name:bcff15ba13367530dcce427ad2613d69.exe
Download: download sample
Signature ResolverRAT
Create hunting rule
File size:17'538'888 bytes
First seen:2025-06-29 07:08:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e859dd0409c406b4558a8d7b196d17f1 (1 x ResolverRAT, 1 x QuasarRAT)
ssdeep 393216:D+UP6QSdLSf1WGtg6+4lI6OB9DuthNN4oG87Ad2fki3YXXi85u:DhyQySNWilIvmzt02D/9
Threatray 305 similar samples on MalwareBazaar
TLSH T1C707332236D51039C0F7C5B17CEC5A60BC747DB1AA869A6B938C57CE69380D16A7CF23
TrID 62.2% (.EXE) InstallShield setup (43053/19/16)
15.2% (.EXE) Win64 Executable (generic) (10522/11/4)
7.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon f0968ee8aae8e8b2 (9 x Urelas, 5 x HermeticWiper, 4 x Starcat)
Reporter abuse_ch
Tags:exe ResolverRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
417
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2025-06-28 15:43:13 UTC
Tags:
lumma stealer themida loader amadey botnet rdp auto generic autoit auto-startup evasion lclipper clipper hijackloader auto-reg telegram stealc ip-check ims-api arkeistealer vidar
Link:
https://app.any.run/tasks/a5f1a1fc-378d-4fe6-a3f4-f15682c86bd6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/11513/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6860e6b537c3436779470cae
Tags:
downloader dropper nemty virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% subdirectories
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Сreating synchronization primitives
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/cc70a61a7972a8a29fb6fa6123793f48ad14250e53128cd61228fdd848b86018
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5005e96a-c7d0-46a0-90f5-60ebf78f005f
Result
Threat name:
ResolverRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1724946
Signature
.NET source code contains very large array initializations
Creates autostart registry keys with suspicious names
Early bird code injection technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
System process connects to network (likely due to code injection or exploit)
Yara detected ResolverRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1724946 Sample: TXf6o47Rdw.exe Startdate: 29/06/2025 Architecture: WINDOWS Score: 100 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected ResolverRAT 2->39 41 .NET source code contains very large array initializations 2->41 43 Joe Sandbox ML detected suspicious sample 2->43 6 TXf6o47Rdw.exe 1 3 2->6         started        10 CF7MVTkx.exe 1 2->10         started        12 CF7MVTkx.exe 1 2->12         started        process3 file4 31 C:\Users\user\AppData\...\CF7MVTkx.exe, PE32 6->31 dropped 33 C:\Users\...\CF7MVTkx.exe:Zone.Identifier, ASCII 6->33 dropped 45 Early bird code injection technique detected 6->45 47 Creates autostart registry keys with suspicious names 6->47 49 Injects code into the Windows Explorer (explorer.exe) 6->49 51 Queues an APC in another process (thread injection) 6->51 14 explorer.exe 2 6->14         started        18 WerFault.exe 19 16 6->18         started        53 Multi AV Scanner detection for dropped file 10->53 21 explorer.exe 3 10->21         started        23 WerFault.exe 4 21 10->23         started        25 explorer.exe 2 12->25         started        27 WerFault.exe 21 12->27         started        signatures5 process6 dnsIp7 35 147.135.244.43, 40000 OVHFR France 14->35 55 System process connects to network (likely due to code injection or exploit) 14->55 57 Found many strings related to Crypto-Wallets (likely being stolen) 14->57 29 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->29 dropped file8 signatures9
Score:
18%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/cc70a61a7972a8a29fb6fa6123793f48ad14250e53128cd61228fdd848b86018
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable PE (Portable Executable) SFX 7z Win 32 Exe x86
Link:
https://app.malva.re/file/bcff15ba13367530dcce427ad2613d69
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc70a61a7972a8a29fb6fa6123793f48ad14250e53128cd61228fdd848b86018/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-06-28 16:26:44 UTC
File Type:
PE (Exe)
Extracted files:
1504
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zrykmgtzokukfh5w7jqsg6j7jcwrijiokmjizvqsfd65qsfymama._file
Verdict:
malicious
Label(s):
resolverrat
Create hunting rule
Similar samples:
11038fee1fb700d5d0482c7dbdaecababedddbd5049d471205849ebe2d97ae09
ResolverRAT
1ecc353c089e2581af25543adfbcf3d1600d622c5f908a4012e2f73b6d38fc3f
ResolverRAT
40dfa88543539053fe9175c88cb958b494d78f3fca793ea482ded480a30212a1
ResolverRAT
9861b4a602eee6742bfcb24f2d262a67f0dc768826e1be1acc3ba84c4a15d0f5
ResolverRAT
cef9f2d860d7a38cc0558f762d65fdc91bed28a511989c38e5a9b5513d1c4a1e
ResolverRAT
dc496f12d56a2118fd804e0ea7c33d873ce053cd6ebb7cd91e0ee1f16f0059d3
ResolverRAT
error
ResolverRAT
+ 295 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/250629-hy29zav1fz/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Adds Run key to start application
Executes dropped EXE
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/03c6c70d-66bc-46dc-a743-23fcda4e2395
Unpacked files
SH256 hash:
cc70a61a7972a8a29fb6fa6123793f48ad14250e53128cd61228fdd848b86018
MD5 hash:
bcff15ba13367530dcce427ad2613d69
SHA1 hash:
ae776456d15ad624a23a409a22804bbfc059926b
Link:
https://www.unpac.me/results/36983acb-0f32-4027-bc0f-3f7acaa6eb66/
SH256 hash:
630330592381e74c7bd369f06ac5aaef17ff680461eeae06c17a9f416d392687
MD5 hash:
97f36dd1f2e4fc04c9b41eba52548288
SHA1 hash:
392b6f65fcb32effb79eb3eb8d732c71a36727b4
Link:
https://www.unpac.me/results/36983acb-0f32-4027-bc0f-3f7acaa6eb66/
SH256 hash:
c0370d25db94daeab7c526fe1809a757f5990863453f21007ec9a53ad98291e8
MD5 hash:
2a138f39bfcaa9f359df8b97480ca00b
SHA1 hash:
a856e707a7c7fb946e0dc0e25637b380975a8816
Link:
https://www.unpac.me/results/36983acb-0f32-4027-bc0f-3f7acaa6eb66/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cc70a61a7972/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc70a61a7972a8a29fb6fa6123793f48ad14250e53128cd61228fdd848b86018

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/11513/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::GetTokenInformation
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::ShellExecuteExW
URL_MONIKERS_APICan Download & Execute componentsurlmon.dll::URLDownloadToFileW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetFileAttributesW
KERNEL32.dll::GetTempFileNameW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryInfoKeyW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW

Comments