MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7bcb9f1c69ece698ae4d4f1b9ead0c4d0684f537c538c06d9f39beb41ab8a20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e7bcb9f1c69ece698ae4d4f1b9ead0c4d0684f537c538c06d9f39beb41ab8a20
SHA3-384 hash:	e1db3ed94adeed5853dc47bcc1ab267851b44f524f03af77faca36e105f56a8c3846867610664c9d37b498161817fb75
SHA1 hash:	4708c2b874e285deadab3a000392a1d271bbe0bd
MD5 hash:	1898abf94e47234b0950d890d514ab3e
humanhash:	vermont-aspen-alabama-bravo
File name:	e7bcb9f1c69ece698ae4d4f1b9ead0c4d0684f537c538c06d9f39beb41ab8a20
Download:	download sample
Signature	Lazarus Alert Create hunting rule
File size:	178'625 bytes
First seen:	2025-02-20 07:44:25 UTC
Last seen:	Never
File type:
MIME type:	text/plain
ssdeep	3072:Ed6254iZ0bXioCyDScMjGbjAfHx3TlcFTK5qVjMqAyRvqn9S56q6ZF0tlsM2:o6ZiZG4y2jGbjU3TlcosVjjAv9RxZ+t+
TLSH	T1AB04F140B4A0AD762E10D5F365335848BB98D4877D247F8AE821F5E329F573A8DDF20A
Magika	txt
Reporter	TheRavenFile
Tags:	Lazarus marstech py

RakeshKrish12

Source: https://github.com/TheRavenFile/Daily-Hunt/blob/main/Lazarus/Marstech.txt

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

110

Origin country :

IN

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Python.Nukesped-G.31367.16734.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b6ea8428ab76d43a5c235a

Tags:

nukesped

Hybrid Analysis Troj/PySteal

Verdict:

Suspicious

Labled as:

Troj/PySteal

Link:

https://www.hybrid-analysis.com/sample/e7bcb9f1c69ece698ae4d4f1b9ead0c4d0684f537c538c06d9f39beb41ab8a20

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

11%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/e7bcb9f1c69ece698ae4d4f1b9ead0c4d0684f537c538c06d9f39beb41ab8a20

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e7bcb9f1c69ece698ae4d4f1b9ead0c4d0684f537c538c06d9f39beb41ab8a20/

ReversingLabs TitaniumCloud Script-Python.Dropper.Nukesped

Threat name:

Script-Python.Dropper.Nukesped

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-28 06:39:25 UTC

File Type:

Text

AV detection:

4 of 38 (10.53%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=466lt4ogt3hgtcxe2ty3t2wqytigqt2tprjyybwz6on6wqnlriqa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250220-kjabrasn19/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e7bcb9f1c69ece698ae4d4f1b9ead0c4d0684f537c538c06d9f39beb41ab8a20