MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe261013faaf34429df7459f6d1ba9e1f2fc9def540976cfa11a6b653f1f20d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe261013faaf34429df7459f6d1ba9e1f2fc9def540976cfa11a6b653f1f20d3
SHA3-384 hash: 6d96db0c6f65836673fbc6bc07bfc0329c8e755ecc5eb27a75d071dbca5981ab4c234314c952deb59e54393727673ae3
SHA1 hash: 07f7a95b2037e03269f9d85ce905ab8d2dab6e14
MD5 hash: a8a5cca4abac6b158d41b653eacc9a16
humanhash: wisconsin-missouri-neptune-iowa
File name:fe261013faaf34429df7459f6d1ba9e1f2fc9def540976cfa11a6b653f1f20d3
Download: download sample
File size:953'976 bytes
First seen:2025-02-07 13:21:29 UTC
Last seen:2025-02-07 14:15:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b8494300a1f7342d4c600a7b12e15925 (3 x RedLineStealer, 3 x RemoteManipulator, 3 x AnyDesk)
ssdeep 24576:fX48QE+U9lzlJSuoBa6xGuPAIV8D/6kN1betf2Zo0bKrc:fXz+/UM/ID6yBetOA4
TLSH T183150228F5022235D09357744CD3E26DFA35EE48562AD8CBB6D87F09DB331EA191938E
TrID 93.8% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
2.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.4% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
0.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon 0000000000000000 (903 x AgentTesla, 559 x Formbook, 316 x RedLineStealer)
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
543
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Filecoder.I.dropper.22548.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67a60a0eab8a2d1c6bcd7a54
Tags:
vmdetect delphi madi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Delayed reading of the file
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Searching for synchronization primitives
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint fingerprint installer keylogger lolbin netsh obfuscated overlay packed packed packer_detected
Link:
https://www.filescan.io/uploads/67a6090bc039745a58bed284/reports/ce122cd8-7a96-424d-bb35-89f01aa4ee85/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/fe261013faaf34429df7459f6d1ba9e1f2fc9def540976cfa11a6b653f1f20d3
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/15132d34-746f-4e62-ac20-c135ee18b923
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1609222
Signature
Allocates memory in foreign processes
Detected unpacking (changes PE section rights)
Disables DEP (Data Execution Prevention) for certain images
Disables Windows Defender (via service or powershell)
Downloads files with wrong headers with respect to MIME Content-Type
Drops PE files with benign system names
Found stalling execution ending in API Sleep call
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global get message hook
Machine Learning detection for sample
Modifies Group Policy settings
Modifies power options to not sleep / hibernate
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
Uses netsh to modify the Windows network and firewall settings
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses powercfg.exe to modify the power settings
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1609222 Sample: zHH1eSjWTK.exe Startdate: 07/02/2025 Architecture: WINDOWS Score: 100 92 anyhostings.ru 2->92 94 x1.i.lencr.org 2->94 96 7 other IPs or domains 2->96 112 Suricata IDS alerts for network traffic 2->112 114 Multi AV Scanner detection for submitted file 2->114 116 Downloads files with wrong headers with respect to MIME Content-Type 2->116 118 3 other signatures 2->118 10 zHH1eSjWTK.exe 302 9 2->10         started        14 AnyDesk.exe 2->14         started        17 AnyDesk.exe 2->17         started        19 8 other processes 2->19 signatures3 process4 dnsIp5 90 C:\Intel\curl.exe, PE32 10->90 dropped 138 Disables DEP (Data Execution Prevention) for certain images 10->138 140 Modifies the windows firewall 10->140 142 Disables Windows Defender (via service or powershell) 10->142 21 cmd.exe 10->21         started        24 cmd.exe 2 10->24         started        27 Acrobat.exe 20 67 10->27         started        29 14 other processes 10->29 104 relay-7360779b.net.anydesk.com 89.187.179.162, 443, 49833, 49839 CDN77GB Czech Republic 14->104 106 boot.net.anydesk.com 57.128.64.30, 443, 49817, 49821 ATGS-MMD-ASUS Belgium 14->106 108 239.255.102.18 unknown Reserved 14->108 144 Detected unpacking (changes PE section rights) 14->144 146 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 14->146 148 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->148 152 2 other signatures 14->152 150 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->150 110 127.0.0.1 unknown unknown 19->110 file6 signatures7 process8 file9 120 Uses ping.exe to sleep 21->120 31 cmd.exe 21->31         started        34 curl.exe 21->34         started        38 driver.exe 21->38         started        48 11 other processes 21->48 88 C:\Intel\rezet.cmd, ASCII 24->88 dropped 122 Uses powercfg.exe to modify the power settings 24->122 124 Uses ping.exe to check the status of other devices and networks 24->124 126 Uses netsh to modify the Windows network and firewall settings 24->126 128 Modifies power options to not sleep / hibernate 24->128 40 conhost.exe 24->40         started        42 AcroCEF.exe 106 27->42         started        44 conhost.exe 29->44         started        46 conhost.exe 29->46         started        50 12 other processes 29->50 signatures10 process11 dnsIp12 154 Modifies power options to not sleep / hibernate 31->154 52 dc.exe 31->52         started        56 cmd.exe 31->56         started        58 AnyDesk.exe 31->58         started        64 4 other processes 31->64 98 anyhostings.ru 89.110.65.154, 49716, 49719, 49725 RECONNRU Ukraine 34->98 68 C:\Intel\driver.exe, PE32 34->68 dropped 156 Found stalling execution ending in API Sleep call 34->156 158 Drops PE files with benign system names 34->158 70 C:\Intel\Trays\Trays.exe, PE32 38->70 dropped 72 C:\Intel\Trays\ShellEh6055x64.dll, PE32+ 38->72 dropped 74 C:\Intel\Trays\ShellEh6055.dll, PE32 38->74 dropped 84 5 other files (1 malicious) 38->84 dropped 100 e8652.dscx.akamaiedge.net 2.23.197.184, 49715, 80 CWVodafoneGroupPLCEU European Union 42->100 60 AcroCEF.exe 44->60         started        102 www.4t-niagara.com 94.23.158.211, 49797, 50002, 50004 OVHFR France 48->102 76 C:\Intel\svchost.exe, PE32 48->76 dropped 78 C:\Intel\dc.exe, PE32 48->78 dropped 80 C:\Intel\AnyDesk\AnyDesk.exe, PE32 48->80 dropped 82 C:\Intel\blat.exe, PE32 48->82 dropped 160 Detected unpacking (changes PE section rights) 48->160 162 Installs a global get message hook 48->162 164 Hides that the sample has been downloaded from the Internet (zone.identifier) 48->164 62 4t-min64.exe 48->62         started        file13 signatures14 process15 file16 86 C:\Windows\System32behaviorgraphroupPolicy\gpt.ini, ASCII 52->86 dropped 130 Multi AV Scanner detection for dropped file 52->130 132 Allocates memory in foreign processes 52->132 134 Modifies Group Policy settings 52->134 66 dc.exe 52->66         started        136 Installs a global get message hook 62->136 signatures17 process18
Score:
88%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fe261013faaf34429df7459f6d1ba9e1f2fc9def540976cfa11a6b653f1f20d3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe261013faaf34429df7459f6d1ba9e1f2fc9def540976cfa11a6b653f1f20d3/
Threat name:
Win32.Exploit.Generic
Create hunting rule
Status:
Malicious
First seen:
2025-02-06 21:10:51 UTC
File Type:
PE (Exe)
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ytbae72v42efhpxiwpw2g5j4hzpzhppkqexnt5bdjvwkpy7edjq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
credential_access defense_evasion discovery evasion execution persistence privilege_escalation trojan
Link:
https://tria.ge/reports/250207-qmba4stlgk/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Launches sc.exe
Drops file in System32 directory
Adds Run key to start application
Checks installed software on the system
Power Settings
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Windows security modification
Downloads MZ/PE file
Modifies Windows Firewall
Sets file to hidden
Stops running service(s)
OS Credential Dumping: Security Account Manager
Modifies Windows Defender DisableAntiSpyware settings
Modifies security service
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e2f07a0b-f800-4bd7-a753-5dcad8575ecf
Unpacked files
SH256 hash:
fe261013faaf34429df7459f6d1ba9e1f2fc9def540976cfa11a6b653f1f20d3
MD5 hash:
a8a5cca4abac6b158d41b653eacc9a16
SHA1 hash:
07f7a95b2037e03269f9d85ce905ab8d2dab6e14
Link:
https://www.unpac.me/results/4c610345-ff8b-4419-916f-154ebf5b9bff/
SH256 hash:
8a8d3d2dab0d6c63f8c34be0c5edaf8ad06452868e92308a9df8b3c119821a0c
MD5 hash:
8d09edbcac133174a5b32097c8cb15e5
SHA1 hash:
924bf43859db9d175bef96ae9f8ada38d378705f
Link:
https://www.unpac.me/results/4c610345-ff8b-4419-916f-154ebf5b9bff/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fe261013faaf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fe261013faaf34429df7459f6d1ba9e1f2fc9def540976cfa11a6b653f1f20d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User Authorizationadvapi32.dll::AllocateAndInitializeSid
advapi32.dll::EqualSid
advapi32.dll::FreeSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediagdi32.dll::StretchDIBits
winmm.dll::timeKillEvent
winmm.dll::timeSetEvent
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
advapi32.dll::GetTokenInformation
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExA
shell32.dll::ShellExecuteA
shell32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and Threadsadvapi32.dll::OpenProcessToken
kernel32.dll::OpenProcess
advapi32.dll::OpenThreadToken
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::TerminateProcess
kernel32.dll::LoadLibraryA
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::WinExec
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::GetWindowsDirectoryA
kernel32.dll::GetSystemDirectoryA
kernel32.dll::GetFileAttributesA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
advapi32.dll::GetUserNameA
advapi32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegCreateKeyExA
advapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryInfoKeyA
advapi32.dll::RegQueryValueExA
advapi32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments