MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982
SHA3-384 hash: 8f8e9c2173f28c28ebc65e71d318b926bb808b7c3abafbdb54377b3e7704c973da0e860547a14e1489d475d353dd7599
SHA1 hash: 6050e3ba5974b49f1ea68c892af983b8bd7b90fb
MD5 hash: 297daa9a090b61b3f04a8530126e3732
humanhash: lemon-november-july-michigan
File name:svchost.exe
Download: download sample
File size:8'445'956 bytes
First seen:2025-11-23 09:27:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d234bbdb9c26cfe757fd564353e7694
ssdeep 196608:Z0y5tA1HeT39IigFeE9TFa0Z8DOjCdylVSE/GoznzZBW0C3KXQ:Z0y5m1+TtIiRY9Z8D8CclsSGorM3KXQ
TLSH T1AE86231AA2A504B5FDB7D13895D38A12EAF27856237CD2DF13A0D6642F337F06938B11
TrID 64.5% (.EXE) InstallShield setup (43053/19/16)
15.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.0% (.ICL) Windows Icons Library (generic) (2059/9)
3.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Hexastrike
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
12
Origin country :
IE IE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
svchost.exe
Verdict:
Malicious activity
Analysis date:
2025-11-23 17:30:12 UTC
Tags:
auto-sch auto-reg antivm pyinstaller
Link:
https://app.any.run/tasks/d6d3e27c-9c5b-4949-80d9-c55d33ba1a5f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/40716/
Gathering data
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Running batch commands
Launching a process
Creating a file in the %temp% directory
Loading a suspicious library
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm cmd evasive expand fingerprint lolbin microsoft_visual_cc packed schtasks
Link:
https://www.filescan.io/uploads/6922dd925d3feebe12d813b3/reports/e4e19a94-9b68-4d8e-9dbc-5e7406031414/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982
Result
Gathering data
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/297daa9a090b61b3f04a8530126e3732
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-21 16:45:03 UTC
File Type:
PE+ (Exe)
Extracted files:
18
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=urnh7o2azfeiztj422hchueukemgyl56iwe2jyepch2lqv4xdgba._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution persistence pyinstaller
Link:
https://tria.ge/reports/251123-l7kcasen9y/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Adds Run key to start application
Drops startup file
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e0449115-50d5-48a0-868a-aac3e272b943
Unpacked files
SH256 hash:
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 hash:
e547cf6d296a88f5b1c352c116df7c0c
SHA1 hash:
cafa14e0367f7c13ad140fd556f10f320a039783
Link:
https://www.unpac.me/results/9aa8567d-99eb-4dd0-a7bf-749b381d5204/
SH256 hash:
5bdc4039f627dabfd27ddaa6f673d4e16ec9a383a2afbc7e10c1b55f15ec19d1
MD5 hash:
6eeb34861c3471243ab43e49bb3d16d3
SHA1 hash:
6ae105cc48c59a585b19197d99de4529274a59e3
Detections:
PyInstaller
Create hunting rule
Link:
https://www.unpac.me/results/9aa8567d-99eb-4dd0-a7bf-749b381d5204/
Parent samples :
090827a413e6ad50a360077b68ab78db8482fef91b0b12d2d0a779417a0c847e
2189142d436418a6893b0c7c08529eedb67d5f8aa36271eac64193f6f4af354c
3deb172d25824017c54afd404941f6c502bf81fc0bd96be67a54ddf87c43a921
4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5
885df657c63e0f911aefa9a6f9473d0f32545b7f57823a0be1b0bea5b6f6fd5c
a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982
dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a
SH256 hash:
a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982
MD5 hash:
297daa9a090b61b3f04a8530126e3732
SHA1 hash:
6050e3ba5974b49f1ea68c892af983b8bd7b90fb
Link:
https://www.unpac.me/results/9aa8567d-99eb-4dd0-a7bf-749b381d5204/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Dlls
Create hunting rule
Rule name:Check_Qemu_DeviceMap
Create hunting rule
Rule name:Check_VBox_DeviceMap
Create hunting rule
Rule name:Check_VmTools
Create hunting rule
Rule name:Check_VMWare_DeviceMap
Create hunting rule
Rule name:Check_Wine
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxProductID
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox product IDs
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:win_rat_generic
Create hunting rule
Author:Reedus0
Description:Rule for detecting generic RAT malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/40716/

Comments