MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f56f9732187f7fac68e2fb7d0a690af52c42edba319a890b5882f2566ef2cd8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f56f9732187f7fac68e2fb7d0a690af52c42edba319a890b5882f2566ef2cd8d
SHA3-384 hash:	0cf2e582c55e74a79894744956ef64eef899f4293eb429d2041fb0fa4e67b4f2d87c42bda1acc1bf5ea4fe2a66a441f6
SHA1 hash:	83261d1f26780a3a94ed515e88382cdde8e93154
MD5 hash:	2ee9e23d49bd79b82b1a9073a9ffc1fd
humanhash:	minnesota-mockingbird-bacon-ohio
File name:	svchost.exe
Download:	download sample
File size:	91'494 bytes
First seen:	2025-11-23 09:32:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	088303a3216315a2ba8d66c94c7b80a0 (16 x Simda)
ssdeep	1536:O0mD88+lawwrnxo199XrTZBBlgqhcsW5HwP6U/GCuO6PFz4I:BmI8+VGe1X5iS05QiU/maI
TLSH	T11A93F1226A0C8D66C689257F22E7EB1416BBF2A81347DB9F5C50110B5D77EC43E3B7A0
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	Hexastrike
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

61

Origin country :

IE

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/40986/

ClamAV

Gathering data

CyberFortress

Gathering data

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context fingerprint installer-heuristic overlay packed packed

Link:

https://www.filescan.io/uploads/6922e5f6eecb08e4aa45abd0/reports/45707ac9-8abd-4ac4-9698-fe1c50b09d4c/overview

Hybrid Analysis Trojan.Shiz

Verdict:

Malicious

Labled as:

Trojan.Shiz

Link:

https://www.hybrid-analysis.com/sample/f56f9732187f7fac68e2fb7d0a690af52c42edba319a890b5882f2566ef2cd8d

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-21T13:26:00Z UTC

Last seen:

2025-11-22T02:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f56f9732187f7fac68e2fb7d0a690af52c42edba319a890b5882f2566ef2cd8d/results?tab=lookup

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/f56f9732187f7fac68e2fb7d0a690af52c42edba319a890b5882f2566ef2cd8d

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE Memory-Mapped (Dump)

Link:

https://app.malva.re/file/2ee9e23d49bd79b82b1a9073a9ffc1fd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f56f9732187f7fac68e2fb7d0a690af52c42edba319a890b5882f2566ef2cd8d/

ReversingLabs TitaniumCloud Win32.Trojan.Emotet

Threat name:

Win32.Trojan.Emotet

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-21 19:56:49 UTC

File Type:

PE (Exe)

Extracted files:

2

AV detection:

24 of 36 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6vxzomqyp572y2hc7n6qu2ik6uwef3n2ggnisc2yqlzfm3xszwgq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251123-mqnttsfj5s/

UnpacMe

Unpacked files

SH256 hash:

f56f9732187f7fac68e2fb7d0a690af52c42edba319a890b5882f2566ef2cd8d

MD5 hash:

2ee9e23d49bd79b82b1a9073a9ffc1fd

SHA1 hash:

83261d1f26780a3a94ed515e88382cdde8e93154

Link:

https://www.unpac.me/results/c5f3639d-f886-4ca3-8e6b-bbfa9c588cb4/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/f56f9732187f7fac68e2fb7d0a690af52c42edba319a890b5882f2566ef2cd8d

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/40986/