MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5
SHA3-384 hash: aa26ff9836f33761dda53865240c6db72b6c6b824f4e9026fa7ac973d18c738176f9ec97b107b54e0e079125325d220b
SHA1 hash: 89372fb526b2155c68371f6bd567efb9c194eeeb
MD5 hash: 29b2acae56af2ef40dd20c253f28bf1c
humanhash: six-oxygen-mexico-hamper
File name:svchost.exe
Download: download sample
File size:8'229'888 bytes
First seen:2025-11-23 09:21:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7d1e2eb3b49f4770c4fb61600805c72e
ssdeep 196608:K5tA1HeT39IigFeE9TFa0Z8DOjCdylVSE/GoznzZBW0C3n:K5m1+TtIiRY9Z8D8CclsSGorM3n
TLSH T1AB86330572B509F6E9B7D079D2D38A22EAB2B8560375C3DF73A482642F237F45934B12
TrID 39.5% (.EXE) InstallShield setup (43053/19/16)
28.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.6% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Hexastrike
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
7
Origin country :
IE IE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/40364/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6922da1f140de26f6c2c8f45
Tags:
autorun malex
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Running batch commands
Launching a process
DNS request
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm cmd expand lolbin microsoft_visual_cc packed schtasks
Link:
https://www.filescan.io/uploads/6922d7167d011c9c3a488710/reports/dfef80c3-c84c-443f-8d76-e2b274d07a8f/overview
Verdict:
Malicious
Labled as:
Trojan.Malware.Generic
Link:
https://www.hybrid-analysis.com/sample/4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5
Result
Gathering data
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/29b2acae56af2ef40dd20c253f28bf1c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5/
Threat name:
Win32.Trojan.Malex
Create hunting rule
Status:
Malicious
First seen:
2025-11-21 11:49:37 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jge2wkobxlqrb5nnkvpsd2pd2olildlpwdc4vrxeek3urd6h7tkq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery execution persistence pyinstaller
Link:
https://tria.ge/reports/251123-lpq25aej9z/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Adds Run key to start application
Drops startup file
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9a6853e6-94a3-4f18-a13a-213a848335c3
Unpacked files
SH256 hash:
4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5
MD5 hash:
29b2acae56af2ef40dd20c253f28bf1c
SHA1 hash:
89372fb526b2155c68371f6bd567efb9c194eeeb
Link:
https://www.unpac.me/results/0edff9b0-53de-4083-a865-64c80c5b0de6/
SH256 hash:
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 hash:
e547cf6d296a88f5b1c352c116df7c0c
SHA1 hash:
cafa14e0367f7c13ad140fd556f10f320a039783
Link:
https://www.unpac.me/results/0edff9b0-53de-4083-a865-64c80c5b0de6/
SH256 hash:
5bdc4039f627dabfd27ddaa6f673d4e16ec9a383a2afbc7e10c1b55f15ec19d1
MD5 hash:
6eeb34861c3471243ab43e49bb3d16d3
SHA1 hash:
6ae105cc48c59a585b19197d99de4529274a59e3
Detections:
PyInstaller
Create hunting rule
Link:
https://www.unpac.me/results/0edff9b0-53de-4083-a865-64c80c5b0de6/
Parent samples :
090827a413e6ad50a360077b68ab78db8482fef91b0b12d2d0a779417a0c847e
2189142d436418a6893b0c7c08529eedb67d5f8aa36271eac64193f6f4af354c
3deb172d25824017c54afd404941f6c502bf81fc0bd96be67a54ddf87c43a921
4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5
885df657c63e0f911aefa9a6f9473d0f32545b7f57823a0be1b0bea5b6f6fd5c
a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982
dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/40364/

Comments