MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AnyDesk


Vendor detections: 14


Intelligence 14 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca
SHA3-384 hash: 6dbf54ec8045195b75198cedf88e6c63c76abd26e46db10b5c49a47b2f88002084247b04250371733dcbeadf32d869a6
SHA1 hash: a95c5bce0656464a53c0093d3268ccfd37769d34
MD5 hash: 8ed87e97879cba7b64d61445991312a6
humanhash: orange-solar-pasta-ink
File name:fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca
Download: download sample
Signature AnyDesk
Create hunting rule
File size:2'484'761 bytes
First seen:2025-06-05 09:59:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c9adc83b45e363b21cd6b11b5da0501f (82 x ArkeiStealer, 60 x RecordBreaker, 46 x RedLineStealer)
ssdeep 49152:yAI+MlP4xo6ngzcZKHFy8ZNEQS2VIjYETYKx+UIGrzU4VxxA5W8ZH/3:yAI+AgZngzy442V/sDJIGPdxxCW8ZH/3
Threatray 771 similar samples on MalwareBazaar
TLSH T1A1B512E8A302E234D0529EF0089FC375B93DF647869697CB72D50E359A3F1EE11152BA
TrID 94.7% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
2.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.4% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
0.6% (.EXE) Win32 Executable (generic) (4504/4/1)
0.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon f0cc96969696c4f0 (1 x AnyDesk)
Reporter adrian__luca
Tags:AnyDesk exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
486
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca
Verdict:
Malicious activity
Analysis date:
2025-06-05 09:43:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3da33173-ef76-4734-8a0e-6576be5510c4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/7448/
Detection(s):
SecuriteInfo.com.PSW.Generic8.ISF.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68416c2507b5e8c1cfe4e014
Tags:
autorun delphi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Delayed reading of the file
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Searching for synchronization primitives
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching a tool to kill processes
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint installer lolbin overlay overlay packed packed packer_detected schtasks
Link:
https://www.filescan.io/uploads/68416ac6fd02ed5e0599a0d3/reports/80f83088-0e42-46a4-bbb2-e0e612e9d123/overview
Verdict:
Malicious
Labled as:
Malware_41.5
Link:
https://www.hybrid-analysis.com/sample/fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2ccdf0a3-46de-446c-ab6a-1e07188baf51
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1707084
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (changes PE section rights)
Found stalling execution ending in API Sleep call
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global get message hook
Multi AV Scanner detection for submitted file
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Rar Usage with Password and Compression Level
Sigma detected: Suspicious Binary Writes Via AnyDesk
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the nircmd tool (NirSoft)
Uses threadpools to delay analysis
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1707084 Sample: v47JTbeGE5.exe Startdate: 05/06/2025 Architecture: WINDOWS Score: 100 89 vniir.nl 2->89 91 x1.i.lencr.org 2->91 93 7 other IPs or domains 2->93 113 Multi AV Scanner detection for submitted file 2->113 115 Sigma detected: Suspicious Binary Writes Via AnyDesk 2->115 117 Sigma detected: Invoke-Obfuscation CLIP+ Launcher 2->117 119 3 other signatures 2->119 9 v47JTbeGE5.exe 281 8 2->9         started        12 sppsvc.exe 2->12         started        15 AnyDesk.exe 2->15         started        18 7 other processes 2->18 signatures3 process4 dnsIp5 85 C:\Users\user\Window\driver.exe, PE32 9->85 dropped 87 C:\Users\user\Window\curl.exe, PE32 9->87 dropped 20 cmd.exe 9->20         started        22 cmd.exe 2 9->22         started        26 Acrobat.exe 20 74 9->26         started        34 16 other processes 9->34 131 Uses threadpools to delay analysis 12->131 28 Conhost.exe 12->28         started        105 relay-2a705639.net.anydesk.com 207.188.6.17, 443, 49746, 49747 MAXIHOSTUS United States 15->105 107 239.255.102.18 unknown Reserved 15->107 133 Detected unpacking (changes PE section rights) 15->133 109 127.0.0.1 unknown unknown 18->109 135 Changes security center settings (notifications, updates, antivirus, firewall) 18->135 30 cmd.exe 18->30         started        32 Conhost.exe 18->32         started        file6 signatures7 process8 file9 36 driver.exe 20->36         started        39 AnyDesk.exe 20->39         started        42 curl.exe 20->42         started        51 6 other processes 20->51 83 C:\Users\user\Window\ghost.cmd, ASCII 22->83 dropped 121 Uses schtasks.exe or at.exe to add and modify task schedules 22->121 45 conhost.exe 22->45         started        47 AcroCEF.exe 76 26->47         started        53 11 other processes 30->53 49 conhost.exe 34->49         started        55 15 other processes 34->55 signatures10 process11 dnsIp12 69 C:\Users\user\Window\nircmd.exe, PE32+ 36->69 dropped 71 C:\Users\user\Window\Trays\Trays.exe, PE32 36->71 dropped 73 C:\Users\user\Window\...\ShellEh6055x64.dll, PE32+ 36->73 dropped 81 10 other files (4 malicious) 36->81 dropped 75 C:\Users\user\Window\AnyDesk\AnyDesk.exe, PE32 39->75 dropped 123 Detected unpacking (changes PE section rights) 39->123 125 Hides that the sample has been downloaded from the Internet (zone.identifier) 39->125 57 AnyDesk.exe 39->57         started        60 AnyDesk.exe 39->60         started        99 vniir.nl 92.63.173.61, 49728, 49739, 49740 ASTRALUSNL Netherlands 42->99 77 C:\Users\user\Window\reg.rar, RAR 42->77 dropped 127 Found stalling execution ending in API Sleep call 42->127 101 e8652.dscx.akamaiedge.net 173.222.137.48, 49726, 80 AKAMAI-ASUS United States 47->101 62 AcroCEF.exe 47->62         started        64 Conhost.exe 49->64         started        103 www.4t-niagara.com 94.23.158.211, 49734, 80 OVHFR France 51->103 79 C:\Users\user\Window\tdata.rar, RAR 51->79 dropped 129 Installs a global get message hook 51->129 66 4t-min64.exe 51->66         started        file13 signatures14 process15 dnsIp16 95 57.128.101.75, 443, 49735, 49738 ATGS-MMD-ASUS Belgium 57->95 97 23.38.184.133, 443, 49732 AKAMAI-ASUS United States 62->97 111 Installs a global get message hook 66->111 signatures17
Score:
91%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-06-05 10:00:29 UTC
File Type:
PE (Exe)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ojhdvk6jm2et7tikv6zkz6ljhrpyfb5dvonyb66e2g5uqnh43fa._file
Verdict:
malicious
Label(s):
admintool_anydesk
Create hunting rule
admintool_nircmd
Create hunting rule
Similar samples:
216a89d7b6ed72c94dedb03eff7dfc83245c3aadb99e76d21c9c722d2fc9fbbc
AnyDesk
7d0c265a99ddc8c5d1eb8744478744c32d7cdf5d63cb39eae490f2fb0f0f8bf4
AnyDesk
83ecb875f87150a88f4c3d496eb3cb5388cd8bafdff4879884ececdbd1896e1d
AnyDesk
ad9093633b9ecaeea7bff69ab8d8781213fec82db6c7f2e963a40d2e0ee0e9ce
AnyDesk
c9cc9c2c2e8c9b51b21b3fab960e7f5f77fba7cd36a300bb2346e820087adeda
AnyDesk
cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
AnyDesk
error
AnyDesk
+ 761 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/250605-l1rg2acq9s/
Behaviour
Checks processor information in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Adds Run key to start application
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads ssh keys stored on the system
Reads user/profile data of web browsers
Modifies Windows Firewall
Sets file to hidden
OS Credential Dumping: Security Account Manager
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/104e21be-8246-465c-864c-c211816a5d05
Unpacked files
SH256 hash:
fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca
MD5 hash:
8ed87e97879cba7b64d61445991312a6
SHA1 hash:
a95c5bce0656464a53c0093d3268ccfd37769d34
Link:
https://www.unpac.me/results/40db8926-b8b3-416d-ac01-ae7c2820b7c4/
SH256 hash:
21782acecff17d85210b526e245cfd1f5ceba28609c0155a43ab92fbf7beff14
MD5 hash:
82ed22bc411102493c37dd76ae10c174
SHA1 hash:
a17505a2a5546d551315db0c226d5f843510ed8a
Link:
https://www.unpac.me/results/40db8926-b8b3-416d-ac01-ae7c2820b7c4/
SH256 hash:
99279006acfedb24f56c491f964c3e456d2f8d4be6c3c7df915cacf2ca618520
MD5 hash:
568ad2e2ca68132bb12c4213063ebbdd
SHA1 hash:
58fe3edb3d7ea4f6f5800d013c1c6789f30611aa
Link:
https://www.unpac.me/results/40db8926-b8b3-416d-ac01-ae7c2820b7c4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fb9271d55e4b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb9271d55e4b3449fe68557d9567cb49e2fc143d1d5cdc07de268dda41a7e6ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Anydesk
Create hunting rule
Author:CD_R0M_
Description:Anydesk is commonly used by threat actors for remote access. This rule aims to identify legitimate anydesk, renamed binaries and trojanized versions.
Reference:https://www.crowdstrike.com/blog/falcon-complete-disrupts-malvertising-campaign-targeting-anydesk/
Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dl_shadow
Create hunting rule
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/7448/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User Authorizationadvapi32.dll::AllocateAndInitializeSid
advapi32.dll::EqualSid
advapi32.dll::FreeSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediagdi32.dll::StretchDIBits
winmm.dll::timeKillEvent
winmm.dll::timeSetEvent
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
advapi32.dll::GetTokenInformation
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExA
shell32.dll::ShellExecuteA
shell32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and Threadsadvapi32.dll::OpenProcessToken
kernel32.dll::OpenProcess
advapi32.dll::OpenThreadToken
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::TerminateProcess
kernel32.dll::LoadLibraryA
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::WinExec
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::GetWindowsDirectoryA
kernel32.dll::GetSystemDirectoryA
kernel32.dll::GetFileAttributesA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
advapi32.dll::GetUserNameA
advapi32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegCreateKeyExA
advapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryInfoKeyA
advapi32.dll::RegQueryValueExA
advapi32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments