MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a
SHA3-384 hash: e14585f3db430eb6476a1d991cfb0121cd84e7d2b9dccb4a6e14cf041aed03f4bfa537a5fab5116ad28b24aefdbeb71a
SHA1 hash: 433f902581e5b1fc93235b7adb2335d9c722c7f0
MD5 hash: 89fef095bd647634da7056c1db5640ed
humanhash: tennis-jupiter-august-uniform
File name:svchost.exe
Download: download sample
File size:8'249'520 bytes
First seen:2025-11-23 09:31:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 287dc88540c6501076605beb78f51232
ssdeep 196608:35tA1HeT39IigFeE9TFa0Z8DOjCdylVSE/GoznzZBW0C3C:35m1+TtIiRY9Z8D8CclsSGorM3C
TLSH T1A186330572F508F6E9B7D1BDD6938A12EAB2B8560375C7CF23A482642F237F45934B12
TrID 66.6% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10522/11/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Hexastrike
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
11
Origin country :
IE IE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/40903/
Gathering data
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Running batch commands
Launching a process
Creating a file in the %temp% directory
Loading a suspicious library
DNS request
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Doina.Generic
Link:
https://www.hybrid-analysis.com/sample/dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a
Result
Gathering data
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-11-21T06:26:00Z UTC
Last seen:
2025-11-22T00:15:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/89fef095bd647634da7056c1db5640ed
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a/
Threat name:
Win64.Trojan.Malex
Create hunting rule
Status:
Malicious
First seen:
2025-11-21 11:19:29 UTC
File Type:
PE+ (Exe)
Extracted files:
18
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3tytgszb46cmxm3g2ttf3wgt36witxmt4agjohp3jmo6ecdz4m5a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution persistence pyinstaller
Link:
https://tria.ge/reports/251123-mgw4vayrcl/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Adds Run key to start application
Drops startup file
Executes dropped EXE
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9cfc6fb5-233f-47b9-af35-6a82bc1e2aaa
Unpacked files
SH256 hash:
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 hash:
e547cf6d296a88f5b1c352c116df7c0c
SHA1 hash:
cafa14e0367f7c13ad140fd556f10f320a039783
Link:
https://www.unpac.me/results/a8d0f1a3-38ba-4a1a-8b91-cadf3a939b0b/
SH256 hash:
5bdc4039f627dabfd27ddaa6f673d4e16ec9a383a2afbc7e10c1b55f15ec19d1
MD5 hash:
6eeb34861c3471243ab43e49bb3d16d3
SHA1 hash:
6ae105cc48c59a585b19197d99de4529274a59e3
Detections:
PyInstaller
Create hunting rule
Link:
https://www.unpac.me/results/a8d0f1a3-38ba-4a1a-8b91-cadf3a939b0b/
Parent samples :
090827a413e6ad50a360077b68ab78db8482fef91b0b12d2d0a779417a0c847e
2189142d436418a6893b0c7c08529eedb67d5f8aa36271eac64193f6f4af354c
3deb172d25824017c54afd404941f6c502bf81fc0bd96be67a54ddf87c43a921
4989ab29c1bae110f5ad555f21e9e3d396858d6fb0c5cac6e422b7488fc7fcd5
885df657c63e0f911aefa9a6f9473d0f32545b7f57823a0be1b0bea5b6f6fd5c
a45a7fbb40c9488ccd3cd68e23d09451186c2fbe4589a4e08f11f4b857971982
dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a
SH256 hash:
dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a
MD5 hash:
89fef095bd647634da7056c1db5640ed
SHA1 hash:
433f902581e5b1fc93235b7adb2335d9c722c7f0
Link:
https://www.unpac.me/results/a8d0f1a3-38ba-4a1a-8b91-cadf3a939b0b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dcf1334b21e784cbb366d4e65dd8d3dfac89dd93e00c971dfb4b1de20879e33a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/40903/

Comments