MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd4cbf92ea784cac5f66251c77869dfe19de753107bf4dd49e24c5ef9041f547. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PoshC2


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd4cbf92ea784cac5f66251c77869dfe19de753107bf4dd49e24c5ef9041f547
SHA3-384 hash: 08181b59aa66dcdb40445b7a10a6a0aca6221e5270a3f0e011383dcca04aabbe859616bdf09c91b1bb03a88e2542f8c4
SHA1 hash: e0b414cdb79bcf38374d6c2f192ff309eb5f623b
MD5 hash: 19413b155189b0166e8a82331929ceea
humanhash: thirteen-montana-ohio-whiskey
File name:SecuriteInfo.com.Trojan.RunPowerShellNET.8.5568.8405
Download: download sample
Signature PoshC2
Create hunting rule
File size:14'848 bytes
First seen:2023-12-04 22:30:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'857 x AgentTesla, 19'783 x Formbook, 12'304 x SnakeKeylogger)
ssdeep 192:TvPshdI479oEjufcW/6Pkrc2+gTbYtXGMa8hURYVt/QnEtpsQrw:TvPshdIq6vT9UUB8hUeV4pQrw
Threatray 20 similar samples on MalwareBazaar
TLSH T14062DA2A39ED502DF1B39FF17EE428DADDAEF2377615945A1081030B8D50E80DE9163E
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:exe poshc2

Intelligence

File Origin
# of uploads :
1
# of downloads :
320
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/462471/
Detection(s):
SecuriteInfo.com.Trojan.RunPowerShellNET.8.5568.8405.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/656e53613636548f3739c7c8/reports/ac66e7ae-d0fd-4bde-b992-3787cdf143b3/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/cd4cbf92ea784cac5f66251c77869dfe19de753107bf4dd49e24c5ef9041f547
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f05ce9bc-4c54-47b5-aa25-d489bfefe882
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1353553
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd4cbf92ea784cac5f66251c77869dfe19de753107bf4dd49e24c5ef9041f547/
Threat name:
ByteCode-MSIL.Hacktool.PoshC2
Create hunting rule
Status:
Malicious
First seen:
2023-12-04 22:32:05 UTC
File Type:
PE (.Net Exe)
AV detection:
19 of 23 (82.61%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvgl7exkpbgkyx3geuohpbu57ym545jra67u3ve6etc67ecb6vdq._file
Verdict:
malicious
Similar samples:
135f703ece7e14ce5dfb7feab1782013a1f555fc9d84b786d673d37ad9bc4708
PoshC2
3e8ae3e3b4718e65437eabfb40d17ec81ac562839da0c803fb75e64bb980bfe7
PoshC2
63229da1bed0c0eafc4ed087651af3eec521e7fbd098300f7d862582d03a675d
PoshC2
757bfe7baa14a89de806a73437b3aec27d8ae6638a0de45e6a81b4d4ad8f3c1c
PoshC2
b7ba11cdb0d4d8d3a0de426337382ae46c271117f20ed49e6ed08aabe5c17a63
PoshC2
ec23523994a89e44162e5476f923b417b692323438d6247e53020fe4898fd23f
PoshC2
+ 10 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231204-2fekqsfh8x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
cd4cbf92ea784cac5f66251c77869dfe19de753107bf4dd49e24c5ef9041f547
MD5 hash:
19413b155189b0166e8a82331929ceea
SHA1 hash:
e0b414cdb79bcf38374d6c2f192ff309eb5f623b
Link:
https://www.unpac.me/results/a0369b14-284b-43a4-8db3-5b7105c266dc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/cd4cbf92ea784cac5f66251c77869dfe19de753107bf4dd49e24c5ef9041f547

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PoshC2

Executable exe cd4cbf92ea784cac5f66251c77869dfe19de753107bf4dd49e24c5ef9041f547

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2737400/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/462471/

Comments