MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a1f287247d9389947ab827cfc2fca7a7cfaa28ad93ed3885fa5fbb272b4b73b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Simda
Vendor detections: 10
| SHA256 hash: | a1f287247d9389947ab827cfc2fca7a7cfaa28ad93ed3885fa5fbb272b4b73b4 |
|---|---|
| SHA3-384 hash: | f1674ea7851e201df6ac7d54bf9d58f407e30f4ffc45963960f7eba718383010f63411600761eede84ab6f3a4aa5f044 |
| SHA1 hash: | bf7fa0163a79902b4313626ea29740bc57861c41 |
| MD5 hash: | fea008029f4bbcd850c3e4f1c845fb47 |
| humanhash: | alaska-berlin-cat-north |
| File name: | svchost.exe |
| Download: | download sample |
| Signature | Simda |
| File size: | 364'032 bytes |
| First seen: | 2025-11-23 09:27:29 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 173abfa8f7d7adac2a90a2e42625b7d9 (27 x Simda, 6 x GuLoader) |
| ssdeep | 3072:hHR4rAH3eBmW7yebDNNDf9yRPzLqE3vAX31XIoWBaZ:Z3EmWPDNND9yRPzLq+YXFqaZ |
| TLSH | T173744B22F6C1D179F4E504B15AFE3A57207D68BA1B1938E3F79869C825B40F23A3C14B |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| Reporter |  Hexastrike |
| Tags: | exe Simda |
Intelligence
File Origin
# of uploads :
1
# of downloads :
15
Origin country :
IEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
svchost.exe
Verdict:
Malicious activity
Analysis date:
2025-11-23 17:50:12 UTC
Tags:
auto-reg anti-evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Gathering data
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for analyzing tools
Creating a file in the Windows subdirectories
Searching for synchronization primitives
Сreating synchronization primitives
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Searching for the anti-virus window
Moving of the original file
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm cmd evasive explorer hacktool lolbin microsoft_visual_cc packed
Verdict:
Malicious
Labled as:
Dacic.4629.Generic
Result
Gathering data
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE Memory-Mapped (Dump)
Threat name:
Win32.Backdoor.Simda
Status:
Malicious
First seen:
2025-11-23 04:11:21 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
29 of 36 (80.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Modifies WinLogon
Executes dropped EXE
Verdict:
Malicious
Tags:
stealer simda Win.Trojan.Shiz-9885535-0
YARA:
win_simda_auto
Unpacked files
SH256 hash:
1ef952347051cabae1484f4e68015aeaf8c3821ad77fd992fb50d1438d677761
MD5 hash:
144ebfac1b23533d5ecff82fdb674178
SHA1 hash:
ceb9ab91a522e6586f58cd04fac444641750b15d
Detections:
win_simda_auto
SH256 hash:
2e7ccf6e4e395eb234996e1a72da1aef731baade7dff3861b1a62c5440bc8f14
MD5 hash:
175dbf62738b022f4600ba686f122ad3
SHA1 hash:
ffa6a66c5a686243d8ae68bc7983b4caf7fedb03
Detections:
win_simda_auto
SH256 hash:
a1f287247d9389947ab827cfc2fca7a7cfaa28ad93ed3885fa5fbb272b4b73b4
MD5 hash:
fea008029f4bbcd850c3e4f1c845fb47
SHA1 hash:
bf7fa0163a79902b4313626ea29740bc57861c41
Detections:
win_simda_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Check_FindWindowA_iat |
|---|
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | vmdetect |
|---|---|
| Author: | nex |
| Description: | Possibly employs anti-virtualization techniques |
| Rule name: | win_simda_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.simda. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.