🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf342c9ddb0febd3bb4bc132d6a8fce3efa98f5ab481dfcc5202e0187e57481b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AndyDesk


Vendor detections: 14


Intelligence 14 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf342c9ddb0febd3bb4bc132d6a8fce3efa98f5ab481dfcc5202e0187e57481b
SHA3-384 hash: 8518ec95950701f191a8d9a7a3a5e62075e51abed001e4c19306f2c2473d88d4f7ecc58bcd8b72fc833cb5992fd4093c
SHA1 hash: 39070eea7e8cf6c61ec5c703a615ff39a3cc2e1f
MD5 hash: ba886bfe54bff16c7bbd637da6d5f08c
humanhash: oranges-illinois-quebec-spring
File name:документы для регистрации заказа и договор сопровождения.com
Download: download sample
Signature AndyDesk
Create hunting rule
File size:1'304'572 bytes
First seen:2026-10-30 10:24:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash c9adc83b45e363b21cd6b11b5da0501f (82 x ArkeiStealer, 60 x RecordBreaker, 46 x RedLineStealer)
ssdeep 24576:WAT8QE+kPOcHhiyVJCqK/JZhVtqAjyRMXdS:WAI+67sq0JnVLjykS
TLSH T10355122A724381B5C0510A35484FD2FABA35BF643F67428F72DA7B3D5C3624A5B232E5
TrID 94.7% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
2.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.4% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
0.6% (.EXE) Win32 Executable (generic) (4504/4/1)
0.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon 581cd8c8c8c8e860 (1 x AndyDesk)
Reporter KodaDr
Tags:AndyDesk exe LibrarianGhouls RareWerewolf


Avatar
KodaDr
sc-start@npo-start.xyz ----->>> cf342c9ddb0febd3bb4bc132d6a8fce3efa98f5ab481dfcc5202e0187e57481b

Intelligence

File Origin
# of uploads :
1
# of downloads :
213
Origin country :
RU RU
Vendor Threat Intelligence
Malware configuration found for:
GCleaner
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b677c0cc-f3eb-4619-8fff-11face5b3148/
Malware family:
n/a
ID:
1
File name:
документы для регистрации заказа и договор сопровождения.com
Verdict:
Suspicious activity
Analysis date:
2026-10-30 10:18:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ef5fa6b3-407f-4a5d-8d99-2a2a42b63535

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96149/
Detection(s):
SecuriteInfo.com.PSW.Generic8.ISF.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae4708fb175ade21dce9de5
Tags:
autorun autoit delphi emotet
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug borland_delphi fingerprint installer installer-heuristic lolbin masquerade overlay packed packed reconnaissance schtasks
Link:
https://www.filescan.io/uploads/6ae4705573ebc3b0ae3457e2/reports/6970b4f7-d90c-4500-97bd-ab8ac4179281/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/cf342c9ddb0febd3bb4bc132d6a8fce3efa98f5ab481dfcc5202e0187e57481b
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-30T15:44:00Z UTC
Last seen:
2026-10-31T22:12:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Agentb.semzsg
Link:
https://opentip.kaspersky.com/cf342c9ddb0febd3bb4bc132d6a8fce3efa98f5ab481dfcc5202e0187e57481b/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d508a86-6170-43b7-a883-1a6617ef216f
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1995250
Signature
Bypasses PowerShell execution policy
Detected unpacking (changes PE section rights)
Drops executables to the windows directory (C:\Windows) and starts them
Found PSEXEC tool (often used for remote process execution)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Multi AV Scanner detection for submitted file
Opens network shares
Potential Privilege Escalation using Task Scheduler highest RunLevel
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Suspicious Binary Writes Via AnyDesk
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1995250 Sample: 2#U043e#U0440 #U0441#U043e#... Startdate: 30/10/2026 Architecture: WINDOWS Score: 100 75 mail.versio.nl 2->75 77 relay-1496eef1.net.anydesk.com 2->77 79 3 other IPs or domains 2->79 103 Multi AV Scanner detection for submitted file 2->103 105 Detected unpacking (changes PE section rights) 2->105 107 Sigma detected: Suspicious Binary Writes Via AnyDesk 2->107 109 4 other signatures 2->109 9 2#U043e#U0440 #U0441#U043e#U043f#U0440#U043e#U0432#U043e#U0436#U0434#U0435#U043d#U0438#U044f.com.exe 20 9 2->9         started        12 PsExec.exe 2->12         started        15 AnyDesk.exe 2->15         started        18 2 other processes 2->18 signatures3 process4 dnsIp5 59 C:\temp\extract\curl.exe, PE32 9->59 dropped 61 C:\temp\extract\UnRAR.exe, PE32+ 9->61 dropped 20 cmd.exe 1 9->20         started        22 cmd.exe 1 9->22         started        25 cmd.exe 9->25         started        29 8 other processes 9->29 119 Opens network shares 12->119 27 conhost.exe 12->27         started        91 relay-1496eef1.net.anydesk.com 92.38.148.17, 443, 49730, 49731 GHOSTLU United States 15->91 93 239.255.102.18 unknown ZZ 15->93 file6 signatures7 process8 signatures9 31 UnRAR.exe 7 20->31         started        35 conhost.exe 20->35         started        111 Uses ping.exe to sleep 22->111 113 Uses schtasks.exe or at.exe to add and modify task schedules 22->113 115 Uses ping.exe to check the status of other devices and networks 22->115 117 Potential Privilege Escalation using Task Scheduler highest RunLevel 22->117 48 2 other processes 22->48 37 AnyDesk.exe 25->37         started        39 conhost.exe 25->39         started        41 PsExec.exe 29->41         started        43 PING.EXE 1 29->43         started        46 AcroCEF.exe 106 29->46         started        50 11 other processes 29->50 process10 dnsIp11 63 C:\temp\extract\blat.exe, PE32 31->63 dropped 65 C:\temp\extract\PsExec.exe, PE32 31->65 dropped 67 C:\temp\extract\AutoHotkey64.exe, PE32+ 31->67 dropped 73 2 other malicious files 31->73 dropped 95 Found PSEXEC tool (often used for remote process execution) 31->95 69 C:\Program Files (x86)\AnyDesk\AnyDesk.exe, PE32 37->69 dropped 97 Detected unpacking (changes PE section rights) 37->97 99 Hides that the sample has been downloaded from the Internet (zone.identifier) 37->99 52 AnyDesk.exe 37->52         started        55 AnyDesk.exe 37->55         started        71 C:\Windows\PSEXESVC.exe, PE32 41->71 dropped 101 Opens network shares 41->101 87 127.0.0.1 unknown unknown 43->87 57 AcroCEF.exe 2 46->57         started        89 199.188.200.135, 443, 49713 NAMECHEAP-NET-NamecheapIncUS United States 48->89 file12 signatures13 process14 dnsIp15 81 15.235.218.149, 443, 49726, 49727 OVHFR Singapore 52->81 83 3.224.130.214, 443, 49719 AMAZON-AES-AmazoncomIncUS United States 57->83 85 23.38.160.198, 443, 49723 AKAMAI-AS-AkamaiTechnologiesIncUS United States 57->85
Score:
86%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cf342c9ddb0febd3bb4bc132d6a8fce3efa98f5ab481dfcc5202e0187e57481b
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
CAB:COMPRESSION:NONE Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/ba886bfe54bff16c7bbd637da6d5f08c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf342c9ddb0febd3bb4bc132d6a8fce3efa98f5ab481dfcc5202e0187e57481b/
Threat name:
Win32.Trojan.AdvML
Create hunting rule
Status:
Malicious
First seen:
2026-10-30 10:25:35 UTC
File Type:
PE (Exe)
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z42czho3b7v5ho2lyeznnkh44px2td22wsa57tcsalqbq7sxjanq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/261030-mf3v1acx2j/
Behaviour
System Location Discovery: System Language Discovery
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
check_installed_software DelayBatch UNPROTECT_disable_process win_token Antivirus_strings Disable_Antivirus Powershell CreateScheduledTask
Link:
https://app.threat.zone/submission/09d68e05-d231-4b43-9982-2fa7957c8eae
Unpacked files
SH256 hash:
cf342c9ddb0febd3bb4bc132d6a8fce3efa98f5ab481dfcc5202e0187e57481b
MD5 hash:
ba886bfe54bff16c7bbd637da6d5f08c
SHA1 hash:
39070eea7e8cf6c61ec5c703a615ff39a3cc2e1f
Detections:
check_installed_software
Create hunting rule
Link:
https://www.unpac.me/results/7df47d30-4d86-4ed6-b734-744cce697db5/
SH256 hash:
c4203404164178d4a84ea8c4c055cbb53f73f80f015545bfcde5cefc131437bc
MD5 hash:
a3bb777cbda7bd8c5ac97d930e27438f
SHA1 hash:
bf4cf62cbbe32bdce6600d4ee1f97bd4ff9ccf7b
Link:
https://www.unpac.me/results/7df47d30-4d86-4ed6-b734-744cce697db5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf342c9ddb0febd3bb4bc132d6a8fce3efa98f5ab481dfcc5202e0187e57481b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_b550d7b4_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/96149/

Comments