MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
SHA3-384 hash: ac3acc9621690fd50fb9174a1ab581301cca6bdfa6f9accadf4482cdcc0360a7ec72787cdea1796f9f598615181c7e0b
SHA1 hash: 8391ca015c12b166b806f196b04bb617b3d8d377
MD5 hash: 685f86f41db34f2ec805449037aa32c9
humanhash: july-sad-mexico-seven
File name:f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
Download: download sample
File size:956'418 bytes
First seen:2025-01-08 14:49:13 UTC
Last seen:2025-01-10 14:17:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b8494300a1f7342d4c600a7b12e15925 (3 x RedLineStealer, 3 x RemoteManipulator, 3 x AnyDesk)
ssdeep 24576:/X48QE+UMvlJSuoBa6xGuPAIV8D/6kN1betf2Zo0bKru:/Xz+KUM/ID6yBetOAi
TLSH T17F150219A1022235D49357704CD7E22EF936FF58562AD8CBB6D83F099B331EA151A38F
TrID 88.4% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
5.7% (.EXE) InstallShield setup (43053/19/16)
1.8% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
0.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Magika pebin
File icon (PE):PE icon
dhash icon c0c9c998868898a4 (3 x GuLoader)
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
415
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
Verdict:
Malicious activity
Analysis date:
2025-01-08 14:48:12 UTC
Tags:
loader
Link:
https://app.any.run/tasks/ac9b5f60-c3a5-4da3-beb5-0683f64014ef

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Filecoder.I.dropper.22548.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=677e9161c029bd73f286f1c3
Tags:
autorun delphi madi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Delayed reading of the file
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Searching for synchronization primitives
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint fingerprint installer keylogger lolbin netsh overlay packed packed packer_detected schtasks
Link:
https://www.filescan.io/uploads/677e909e39bb8c94e5adde5a/reports/af4b9732-df29-47ad-aee5-03005c00db3a/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b5b056a4-565b-48cc-9df9-0c271d6a685f
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad.rans
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1585989
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (changes PE section rights)
Disables DEP (Data Execution Prevention) for certain images
Disables Windows Defender (via service or powershell)
Downloads files with wrong headers with respect to MIME Content-Type
Drops PE files with benign system names
Found stalling execution ending in API Sleep call
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global get message hook
Machine Learning detection for sample
Modifies Group Policy settings
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Uses netsh to modify the Windows network and firewall settings
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Defender Control Hacktool
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1585989 Sample: eqRHH2whJu.exe Startdate: 08/01/2025 Architecture: WINDOWS Score: 100 98 downdown.ru 2->98 100 x1.i.lencr.org 2->100 102 4 other IPs or domains 2->102 110 Suricata IDS alerts for network traffic 2->110 112 Antivirus detection for URL or domain 2->112 114 Multi AV Scanner detection for submitted file 2->114 116 6 other signatures 2->116 9 eqRHH2whJu.exe 268 9 2->9         started        13 AnyDesk.exe 2->13         started        16 AnyDesk.exe 2->16         started        18 8 other processes 2->18 signatures3 process4 dnsIp5 90 C:\Intel\curl.exe, PE32 9->90 dropped 146 Disables DEP (Data Execution Prevention) for certain images 9->146 148 Modifies the windows firewall 9->148 150 Disables Windows Defender (via service or powershell) 9->150 20 cmd.exe 9->20         started        23 cmd.exe 2 9->23         started        26 Acrobat.exe 20 81 9->26         started        30 15 other processes 9->30 106 57.129.19.1, 49974, 49980, 6568 ATGS-MMD-ASUS Belgium 13->106 152 Multi AV Scanner detection for dropped file 13->152 154 Detected unpacking (changes PE section rights) 13->154 156 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 13->156 162 3 other signatures 13->162 158 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->158 28 AnyDesk.exe 16->28         started        108 127.0.0.1 unknown unknown 18->108 160 Changes security center settings (notifications, updates, antivirus, firewall) 18->160 file6 signatures7 process8 file9 130 Uses ping.exe to sleep 20->130 32 driver.exe 20->32         started        35 svchost.exe 20->35         started        38 cmd.exe 20->38         started        48 12 other processes 20->48 88 C:\Intel\rezet.cmd, ASCII 23->88 dropped 132 Uses ping.exe to check the status of other devices and networks 23->132 134 Uses netsh to modify the Windows network and firewall settings 23->134 40 conhost.exe 23->40         started        42 AcroCEF.exe 97 26->42         started        44 conhost.exe 30->44         started        46 conhost.exe 30->46         started        51 13 other processes 30->51 signatures10 process11 dnsIp12 70 C:\Intel\Trays\unins000.exe, PE32 32->70 dropped 72 C:\Intel\Trays\delReg.exe, PE32 32->72 dropped 74 C:\Intel\Trays\Trays.exe, PE32 32->74 dropped 84 5 other malicious files 32->84 dropped 76 C:\Intel\AnyDesk\AnyDesk.exe, PE32 35->76 dropped 118 Multi AV Scanner detection for dropped file 35->118 120 Detected unpacking (changes PE section rights) 35->120 122 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->122 53 svchost.exe 35->53         started        57 svchost.exe 35->57         started        59 dc.exe 38->59         started        62 cmd.exe 38->62         started        64 AnyDesk.exe 38->64         started        66 AcroCEF.exe 42->66         started        94 downdown.ru 185.125.51.5, 49745, 49759, 49769 INPLATLABS-ASRU Russian Federation 48->94 96 www.4t-niagara.com 94.23.158.211, 49853, 49893, 50000 OVHFR France 48->96 78 C:\Intel\svchost.exe, PE32 48->78 dropped 80 C:\Intel\driver.exe, PE32 48->80 dropped 82 C:\Intel\dc.exe, PE32 48->82 dropped 86 2 other malicious files 48->86 dropped 124 Found stalling execution ending in API Sleep call 48->124 126 Installs a global get message hook 48->126 128 Drops PE files with benign system names 48->128 68 4t-min64.exe 48->68         started        file13 signatures14 process15 dnsIp16 104 boot.net.anydesk.com 92.223.88.41, 443, 49867, 49873 GCOREAT Austria 53->104 136 System process connects to network (likely due to code injection or exploit) 53->136 92 C:\Windows\System32behaviorgraphroupPolicy\gpt.ini, ASCII 59->92 dropped 138 Multi AV Scanner detection for dropped file 59->138 140 Allocates memory in foreign processes 59->140 142 Modifies Group Policy settings 59->142 144 Installs a global get message hook 68->144 file17 signatures18
Score:
86%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387/
Threat name:
Win32.Spyware.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-12-18 09:48:05 UTC
File Type:
PE (Exe)
AV detection:
21 of 38 (55.26%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6gbxj6tzbrn3666colaqujxvnw4zw7l65yemtbx2jpjaypcfkodq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
credential_access discovery evasion execution persistence privilege_escalation spyware stealer trojan upx
Link:
https://tria.ge/reports/250108-r7k7gstpax/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Launches sc.exe
Drops file in System32 directory
Enumerates processes with tasklist
UPX packed file
Adds Run key to start application
Checks installed software on the system
Command and Scripting Interpreter: PowerShell
Power Settings
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Windows security modification
Blocklisted process makes network request
Downloads MZ/PE file
Modifies Windows Firewall
Sets file to hidden
Stops running service(s)
OS Credential Dumping: Security Account Manager
Modifies security service
Malware Config
Dropper Extraction:
http://bmapps.org/bmcontrol/win64/install.exe
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/82a21e0e-d159-4c7b-9f87-f60ad68dd311
Unpacked files
SH256 hash:
279e1bf1a71d08018ccc624d17af6f22437c7f909bc1647fddc7b282aaa2f8bc
MD5 hash:
d79e98240b3e4d18a215a60f19e22ce2
SHA1 hash:
af39a4c2e89fb902b792f1794ac263a561db3789
Link:
https://www.unpac.me/results/ecd44b05-22cd-42df-aeea-b2fe9ee429ea/
SH256 hash:
f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387
MD5 hash:
685f86f41db34f2ec805449037aa32c9
SHA1 hash:
8391ca015c12b166b806f196b04bb617b3d8d377
Link:
https://www.unpac.me/results/ecd44b05-22cd-42df-aeea-b2fe9ee429ea/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f18374fa790c5bbf7bc272c10a26f56db99b7d7eee08c986fa4bd20c3c455387

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User Authorizationadvapi32.dll::AllocateAndInitializeSid
advapi32.dll::EqualSid
advapi32.dll::FreeSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediagdi32.dll::StretchDIBits
winmm.dll::timeKillEvent
winmm.dll::timeSetEvent
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
advapi32.dll::GetTokenInformation
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExA
shell32.dll::ShellExecuteA
shell32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and Threadsadvapi32.dll::OpenProcessToken
kernel32.dll::OpenProcess
advapi32.dll::OpenThreadToken
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::TerminateProcess
kernel32.dll::LoadLibraryA
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::WinExec
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::GetWindowsDirectoryA
kernel32.dll::GetSystemDirectoryA
kernel32.dll::GetFileAttributesA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
advapi32.dll::GetUserNameA
advapi32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegCreateKeyExA
advapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryInfoKeyA
advapi32.dll::RegQueryValueExA
advapi32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments