MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21cf25785e0ef7789bb7ad3b57399a8e1f159158ddd281d6a78c6f3c5dad97b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21cf25785e0ef7789bb7ad3b57399a8e1f159158ddd281d6a78c6f3c5dad97b4
SHA3-384 hash: ba37c3a7bebbfa6f21a8b08c48a0c5a08aee1727b23ee06be286720d16c468ee8ce9c27f15ee240cb2fc5ae8be2abbc7
SHA1 hash: d4df0125369a6e2bfb79f942371b698a3c640327
MD5 hash: 300e543d7f0f14b723ca1f7e215b3e8e
humanhash: juliet-saturn-nine-papa
File name:SbieDll.dll
Download: download sample
File size:92'629'088 bytes
First seen:2025-11-23 11:43:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c2d02fc98f1d75d7b9457468ec75da0e (1 x Meterpreter)
ssdeep 1572864:050dJKrzDYDr2KYV6uIGjOHNcwUl8kHsLqNDZaeE0C2IEyD5q9jGF/S7Chu:0ydM8Dr276u9SNcD8tqfaeEjsWV9hu
TLSH T1BE1833552315063DE6E9B134EBEA5339E3A02E85024798CB23D0BF673D3B4136FE9259
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Alex_sev
Tags:exe Trojan.Win64.DllHijack Trojan.Win64.Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
BY BY
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SbieDll.dll
Verdict:
No threats detected
Analysis date:
2025-11-23 11:27:57 UTC
Tags:
upx
Link:
https://app.any.run/tasks/235ea1d8-6b75-4708-9487-20c047f23ce3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bloated masquerade overlay packed
Link:
https://www.filescan.io/uploads/6922f36aeecb08e4aa45b840/reports/ddaaf3a5-0fb7-453d-8a8e-abf6f5b6a3aa/overview
Verdict:
Malicious
Labled as:
Win64/Agent_AGeneric.FSG trojan
Link:
https://www.hybrid-analysis.com/sample/21cf25785e0ef7789bb7ad3b57399a8e1f159158ddd281d6a78c6f3c5dad97b4
Result
Gathering data
Verdict:
Malicious
File Type:
dll x64
First seen:
2025-11-23T08:32:00Z UTC
Last seen:
2025-11-23T08:34:00Z UTC
Hits:
~10
Detections:
Trojan.Win64.Loader.sb Trojan.Win32.Agent.rnd HEUR:Trojan.Win64.DLLhijack.gen
Link:
https://opentip.kaspersky.com/21cf25785e0ef7789bb7ad3b57399a8e1f159158ddd281d6a78c6f3c5dad97b4/results?tab=lookup
Score:
32%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/21cf25785e0ef7789bb7ad3b57399a8e1f159158ddd281d6a78c6f3c5dad97b4
Gathering data
Verdict:
Malicious
Threat:
Trojan.Win64.Loader
Link:
https://tip.neiki.dev/file/21cf25785e0ef7789bb7ad3b57399a8e1f159158ddd281d6a78c6f3c5dad97b4
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehhsk6c6b33xrg5xvu5voom2ryprleky3xjidvvhrrxtyxnns62a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/251123-nvxg7sfp4s/
Behaviour
Unexpected DNS network traffic destination
Badlisted process makes network request
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d6065bda-09ad-4d7c-b433-650980880b03
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/235ea1d8-6b75-4708-9487-20c047f23ce3

Comments