MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5760108c797f6b2fb5745f43aff3d2d9e1fa8c4a96c2c60d2f028aecc48ae89f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5760108c797f6b2fb5745f43aff3d2d9e1fa8c4a96c2c60d2f028aecc48ae89f
SHA3-384 hash:	fc9bd0d611acb42eec50eeb76c664cc9ce0cb8efddb76de794b20eaa2cb051ca4742817b5dc1322869fe15d27076a8f9
SHA1 hash:	56cf0d077e3768dbc1eda6efbe291387130fce9a
MD5 hash:	c3e37f31d36d98ca4a0595201410c1d0
humanhash:	utah-mike-fanta-king
File name:	svchost.exe
Download:	download sample
File size:	1'412'196 bytes
First seen:	2025-11-23 09:22:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4d41beacc76045fb1924c6d5c7349c25
ssdeep	24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lAN2kwSk6Ye17lo:7E2lVL3Ze+/F5ndjFWmrjyx1cmNk7YKm
TLSH	T1A1653323B5D090F8CC4928370199E675CBB26AF726F6A6759FE80C6A1C314926F1FF14
Magika	pebin
Reporter	Hexastrike
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

10

Origin country :

IE

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

svchost.exe

Verdict:

Suspicious activity

Analysis date:

2025-11-23 16:47:39 UTC

Tags:

auto-reg

Link:

https://app.any.run/tasks/eadb4e7e-f7f4-4192-9125-18bf42817877

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/40430/

ClamAV Detected

Detection(s):

Win.Trojan.Ulise-10005646-0

Alert

Create hunting rule

Win.Trojan.Agent-1365923

Alert

Create hunting rule

Win.Trojan.Agent-1364139

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6922dc19b6ee81118d2c9e07

Tags:

injection dropper malex virus

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the Windows subdirectories

Creating a file in the Windows directory

Creating a process from a recently created file

Creating a process with a hidden window

Creating a window

Launching a process

Sending a custom TCP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun with the shell\open\command registry branches

Enabling autorun

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context evasive fingerprint overlay overlay packed

Link:

https://www.filescan.io/uploads/6922d85df96b58f0dc80b2c4/reports/408a6f3e-95b3-4fc0-a3b7-cb2a16faa59b/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/5760108c797f6b2fb5745f43aff3d2d9e1fa8c4a96c2c60d2f028aecc48ae89f

InQuest

Result

Gathering data

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/5760108c797f6b2fb5745f43aff3d2d9e1fa8c4a96c2c60d2f028aecc48ae89f

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/c3e37f31d36d98ca4a0595201410c1d0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5760108c797f6b2fb5745f43aff3d2d9e1fa8c4a96c2c60d2f028aecc48ae89f/

ReversingLabs TitaniumCloud Win32.Infostealer.Tinba

Threat name:

Win32.Infostealer.Tinba

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-21 19:58:00 UTC

File Type:

PE (Exe)

AV detection:

33 of 36 (91.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k5qbbddzp5vs7nlul5b2746s3hq7vdcks3bmmdjpakfozrek5cpq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery persistence

Link:

https://tria.ge/reports/251123-lsvjqatjex/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Drops file in Windows directory

Drops file in System32 directory

Adds Run key to start application

Executes dropped EXE

Modifies system executable filetype association

Boot or Logon Autostart Execution: Active Setup

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Win.Trojan.Ulise-10005646-0

YARA:

n/a

Link:

https://app.threat.zone/submission/bc50da74-fd1e-4b9b-8eb8-262002a6ba09

UnpacMe

Unpacked files

SH256 hash:

5760108c797f6b2fb5745f43aff3d2d9e1fa8c4a96c2c60d2f028aecc48ae89f

MD5 hash:

c3e37f31d36d98ca4a0595201410c1d0

SHA1 hash:

56cf0d077e3768dbc1eda6efbe291387130fce9a

Link:

https://www.unpac.me/results/36c9e691-6b0e-41d2-8a31-6848cf002e0f/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5760108c797f6b2fb5745f43aff3d2d9e1fa8c4a96c2c60d2f028aecc48ae89f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/40430/