🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2
SHA3-384 hash: e28db34148ab4ee29dac5e8d6946b5bf66e4b02fb1c7c67a1b42177a2715fb0867be09bc9488865ea469ca830a6e272e
SHA1 hash: 594ed95999b0f6ae906ec4341aa1b956b6b644fa
MD5 hash: 1b5a5babac0a893e6e7856c009925bc7
humanhash: indigo-potato-three-six
File name:0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2.exe
Download: download sample
File size:1'902'080 bytes
First seen:2026-10-14 15:58:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
ssdeep 24576:cJELPQ4wcNJQgtsnEtmi1LmTMPaIngK9rHjlgyyd84XwAhGpdWq:xD1wcjfuEIfMP9gK9rK3dcAcP
TLSH T17695BE0563F85715F2BB6B38993656208F32BC529739C79E368910AD0F71B928C72B73
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 4838f9f8f6c6c010
Reporter ShadowOpCode
Tags:exe RGBLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-14 18:12:35 UTC
Tags:
loader
Link:
https://app.any.run/tasks/0b5d7ec9-9302-49f0-97d1-865db0da3d16

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91855/
Detection(s):
YARA.COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad15ffff4e17c78f715fd24
Tags:
emotet trojan virus krypt
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating synchronization primitives
Searching for synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm base64 fingerprint krypt overlay packed reconnaissance reconnaissance
Link:
https://www.filescan.io/uploads/6acfa6d0ad1c3149fd78f9b2/reports/e57b173c-72cb-4caa-9ca3-2aceac2f8986/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2
Verdict:
Unknown
File Type:
exe x64
Link:
https://opentip.kaspersky.com/0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4d92d110-9488-4eeb-81b4-c676d8e27912
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2
Verdict:
inconclusive
YARA:
8 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.21 Win 64 Exe x64
Link:
https://app.malva.re/file/1b5a5babac0a893e6e7856c009925bc7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=agivak2gpyuj65vaxbng7xkwmitv7y2cy4qsfqx2fpca2lhv3pja._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery
Link:
https://tria.ge/reports/261014-te5frsex6k/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads the TCP/IP host and domain name from the registry
Deletes itself
Executes dropped EXE
Unpacked files
SH256 hash:
0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2
MD5 hash:
1b5a5babac0a893e6e7856c009925bc7
SHA1 hash:
594ed95999b0f6ae906ec4341aa1b956b6b644fa
Detections:
SUSP_NET_Shellcode_Loader_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b1573135-762e-4688-962c-5b9858b0266e/
SH256 hash:
0fa4f1bb3fc9812c8d8ac15b57ba12c40fb81a5f205c1434f5bcb8cdbc3e636d
MD5 hash:
f8be5dab6bbab4d2f712f8b8605a75be
SHA1 hash:
e7f957ed18603b133078bd1b116bcb873f2449c4
Link:
https://www.unpac.me/results/b1573135-762e-4688-962c-5b9858b0266e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/0191502b467e289f76a0b85a6fdd5662275fe342c72122c2fa2bc40d2cf5dbd2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MULTI_Malware_Unknown_ForgeAuto_9d9a5cf9
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_de8d8480
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:SUSP_NET_Shellcode_Loader_Indicators_Jan24
Create hunting rule
Author:Jonathan Peters
Description:Detects indicators of shellcode loaders in .NET binaries
Reference:https://github.com/Workingdaturah/Payload-Generator/tree/main
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/91855/

Comments