MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb916747dc5cf735e07bb1d4fb70591ff93fb40097b3e887537ec9b8096f4bf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb916747dc5cf735e07bb1d4fb70591ff93fb40097b3e887537ec9b8096f4bf8
SHA3-384 hash:	12d45f0a6f03278b6617e8f685d8b68c90d461a7ab34d0cac47ef59377d950d7bfdee5a6e1d353a7ba7559b40b5620d6
SHA1 hash:	eeada035f4c4da04ea5a094f31cd7d21ed7b6692
MD5 hash:	5498be2a2c03927bdc080574478af529
humanhash:	arizona-diet-echo-michigan
File name:	svchost.exe
Download:	download sample
File size:	1'415'317 bytes
First seen:	2025-11-23 09:33:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4d41beacc76045fb1924c6d5c7349c25
ssdeep	24576:76Zv2l4kPQeGy3JF1e5fg/vFP75ni+cKFwdmd9HDyx1Yx2lANCPrHQMHyXUu0:7E2lVL3Ze+/F5ndjFWmrjyx1cmbbOXi
TLSH	T10F653323799090F8C88A5D37005ED7B1DBB2BEB626B56665BFFC187A1C314919A0FB04
Magika	pebin
Reporter	Hexastrike
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

73

Origin country :

IE

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

svchost.exe

Verdict:

Suspicious activity

Analysis date:

2025-11-23 21:47:24 UTC

Tags:

auto-reg

Link:

https://app.any.run/tasks/158c3e86-3fc6-478e-b8e3-b835fe6e1f8c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/41014/

ClamAV Detected

Detection(s):

Win.Trojan.Ulise-10005646-0

Alert

Create hunting rule

Win.Trojan.Agent-1365923

Alert

Create hunting rule

Win.Trojan.Agent-1364139

Alert

Create hunting rule

CyberFortress

Gathering data

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the Windows subdirectories

Creating a window

Creating a file in the Windows directory

Creating a process from a recently created file

Creating a process with a hidden window

Launching a process

Sending a custom TCP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun with the shell\open\command registry branches

Enabling autorun

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context evasive fingerprint overlay overlay packed

Link:

https://www.filescan.io/uploads/6922e618eecb08e4aa45abfb/reports/e0b076e2-7b53-4ae9-9238-bc0e44595101/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/fb916747dc5cf735e07bb1d4fb70591ff93fb40097b3e887537ec9b8096f4bf8

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-22T17:22:00Z UTC

Last seen:

2025-11-23T00:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fb916747dc5cf735e07bb1d4fb70591ff93fb40097b3e887537ec9b8096f4bf8/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/fb916747dc5cf735e07bb1d4fb70591ff93fb40097b3e887537ec9b8096f4bf8

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/5498be2a2c03927bdc080574478af529

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb916747dc5cf735e07bb1d4fb70591ff93fb40097b3e887537ec9b8096f4bf8/

ReversingLabs TitaniumCloud Win32.Infostealer.Tinba

Threat name:

Win32.Infostealer.Tinba

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-22 19:50:00 UTC

File Type:

PE (Exe)

AV detection:

32 of 36 (88.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7oiwor64lt3tlyd3whkpw4czd74t7naas6z6rb2tp3e3qclpjp4a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery persistence

Link:

https://tria.ge/reports/251123-mqqcnazjgl/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Drops file in Windows directory

Drops file in System32 directory

Adds Run key to start application

Executes dropped EXE

Modifies system executable filetype association

Boot or Logon Autostart Execution: Active Setup

Threat.Zone Malicious

Verdict:

Malicious

Tags:

Win.Trojan.Ulise-10005646-0

YARA:

n/a

Link:

https://app.threat.zone/submission/4c842a24-8784-44a7-9f1c-3c3251fd40ba

UnpacMe

Unpacked files

SH256 hash:

fb916747dc5cf735e07bb1d4fb70591ff93fb40097b3e887537ec9b8096f4bf8

MD5 hash:

5498be2a2c03927bdc080574478af529

SHA1 hash:

eeada035f4c4da04ea5a094f31cd7d21ed7b6692

Link:

https://www.unpac.me/results/1bbd31aa-b7e5-40ca-a288-083e6101ddc3/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fb916747dc5cf735e07bb1d4fb70591ff93fb40097b3e887537ec9b8096f4bf8

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/41014/