MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccbd4b60f3df31f3a7dc9bd1b1b9fba22be8ed3378b9c3ec7d4fc06fd0047e62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccbd4b60f3df31f3a7dc9bd1b1b9fba22be8ed3378b9c3ec7d4fc06fd0047e62
SHA3-384 hash: eb01fe1f9ec86e66bc12ed0c421e2d1845525cf336440466a7bd8419c2fc3059aef60caebf9b39eb6729bd6c3cfe7a16
SHA1 hash: d2b5b19e0ef3b473a2ca01a9711d49b71a7fb100
MD5 hash: 7c8518f835b3414b50fe1a90cbb8f6a9
humanhash: purple-hydrogen-whiskey-golf
File name:7c8518f835b3414b50fe1a90cbb8f6a9.exe
Download: download sample
File size:71'680 bytes
First seen:2021-10-07 09:02:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 1536:ufOFM4/aN8PPLpU4n72/YrtgPTHMwGxU:UQl/aGPP32/YrqrHMn2
TLSH T15B63C5B7016295B6C5892334F4A11F0B367CD6341581F698F00FB2AEEC1D69E9AF83B5
File icon (PE):PE icon
dhash icon 5af4a0e98d256329
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup_x86_x64_install.exe
Verdict:
Malicious activity
Analysis date:
2021-10-06 23:04:16 UTC
Tags:
trojan rat redline loader stealer vidar evasion ficker opendir
Link:
https://app.any.run/tasks/5aeeb339-724c-4d8b-8a12-0e94476e506d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195740/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Launching a service
Creating a window
Connection attempt to an infection source
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/615eb7cd98a6280f3933855d/reports/674a83e4-ad5d-44fd-9ed1-9ffc6dd9181e/overview
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/866181
Signature
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccbd4b60f3df31f3a7dc9bd1b1b9fba22be8ed3378b9c3ec7d4fc06fd0047e62/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-10-06 12:17:00 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/211007-kz4wascdcm/
Behaviour
Suspicious use of AdjustPrivilegeToken
Legitimate hosting services abused for malware hosting/C2
Unpacked files
SH256 hash:
d9207941b06a95422e600f1915d04502b7de534ad8343fdbb1bd4801d8d524e4
MD5 hash:
7193f4b3df0bfc3867d97ad7495ba533
SHA1 hash:
09732586462f75eb3127947b0236e22f06b69dad
Link:
https://www.unpac.me/results/8ed02469-01ad-450f-9beb-55aa10fa68da/
SH256 hash:
ccbd4b60f3df31f3a7dc9bd1b1b9fba22be8ed3378b9c3ec7d4fc06fd0047e62
MD5 hash:
7c8518f835b3414b50fe1a90cbb8f6a9
SHA1 hash:
d2b5b19e0ef3b473a2ca01a9711d49b71a7fb100
Link:
https://www.unpac.me/results/8ed02469-01ad-450f-9beb-55aa10fa68da/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/ccbd4b60f3df31f3a7dc9bd1b1b9fba22be8ed3378b9c3ec7d4fc06fd0047e62

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe ccbd4b60f3df31f3a7dc9bd1b1b9fba22be8ed3378b9c3ec7d4fc06fd0047e62

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1639256/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/195740/

Comments