MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02414d1572729bf910a4d7c45a0d391bf0559f68d4cbafd8cb5c070cd1d21b4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02414d1572729bf910a4d7c45a0d391bf0559f68d4cbafd8cb5c070cd1d21b4b
SHA3-384 hash: 69def028956930646c35b7519c64051f8b3bc6336314db7e3fbe0b053ac7eaa27fede19771ce9f6d07430fc411dff94e
SHA1 hash: 4a5894c0833bf1a04bb337c82ddb5e12c8335da6
MD5 hash: 16a836751c892edabee6ae8febf9c93e
humanhash: lima-spring-edward-south
File name:华为版本查询.exe
Download: download sample
File size:847'028 bytes
First seen:2025-07-22 11:50:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (442 x NirCmd, 392 x DCRat, 52 x RedLineStealer)
ssdeep 24576:lTbBv5rUjjwyTLcHUnBu/sRwfOedfhHHt+qqvMXP/yj:PBTyLc2BmLdfhHHtbwW/yj
Threatray 2'686 similar samples on MalwareBazaar
TLSH T139051202BEC1A8B2C46708761B75A711FE7D79302F658EDB73814A5DEE316C0DB316A2
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon f0f8c8e9d9d8f0f0
Reporter Joker
Tags:exe trojan

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
华为版本查询.exe
Verdict:
No threats detected
Analysis date:
2025-07-22 12:02:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f9388b35-40f4-475b-86c7-7793143f8786

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/16333/
Detection(s):
Win.Packed.Zusy-10014517-0
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=687f7b722f623871a5f1c8ef
Tags:
injection obfusc shell
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Running batch commands
Launching a process
Creating a file
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/02414d1572729bf910a4d7c45a0d391bf0559f68d4cbafd8cb5c070cd1d21b4b
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/85d2e55f-a508-45b3-9a13-b752ff7704ed
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/02414d1572729bf910a4d7c45a0d391bf0559f68d4cbafd8cb5c070cd1d21b4b
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/16a836751c892edabee6ae8febf9c93e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02414d1572729bf910a4d7c45a0d391bf0559f68d4cbafd8cb5c070cd1d21b4b/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/02414d1572729bf910a4d7c45a0d391bf0559f68d4cbafd8cb5c070cd1d21b4b
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ajau2flsokn7sefe27cfudjzdpyflh3i2tf27wgllqdqzuosdnfq._file
Verdict:
malicious
Label(s):
unc_loader_048
Create hunting rule
unc_loader_051
Create hunting rule
Similar samples:
10f96939c15a6f55b87d79d5fb6550196a599c5fbe223bca7bedeafdb0f5266e
216a89d7b6ed72c94dedb03eff7dfc83245c3aadb99e76d21c9c722d2fc9fbbc
476f2ddc0f7c7ef512c71a6faadfead61424d57abf2e4566d48b8dd84545c6cb
4ce875b971070af57d416b21c10ac2d260ac8d9855f5117cc51e6d872422c2ac
ac15d82441447b30e13ba57c3c2ab12dae50e7396c74991393bd225f3784aab9
error
+ 2'676 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/250722-n1cpzsvxd1/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
Win.Packed.Zusy-10014517-0
YARA:
n/a
Link:
https://app.threat.zone/submission/75950957-332a-4665-86b1-ecfb11ec5530
Unpacked files
SH256 hash:
02414d1572729bf910a4d7c45a0d391bf0559f68d4cbafd8cb5c070cd1d21b4b
MD5 hash:
16a836751c892edabee6ae8febf9c93e
SHA1 hash:
4a5894c0833bf1a04bb337c82ddb5e12c8335da6
Link:
https://www.unpac.me/results/a8b5d9d5-e048-466b-abd8-4c8fdbd48cc3/
SH256 hash:
7221828e88459bb236f3c8f446f102737ba2260f1636cf64c58b8af70bc3a215
MD5 hash:
4bfc58f50e7fc4da38b74f1698e6cf08
SHA1 hash:
bdbbd1bc2ce545c2ed77b3c00f87c10bf3972e00
Detections:
SUSP_Imphash_Mar23_3
Create hunting rule
Link:
https://www.unpac.me/results/a8b5d9d5-e048-466b-abd8-4c8fdbd48cc3/
SH256 hash:
504e9f1a3c4a7475844cc7580bf98653815d38bfa5305805e630fb4abd712f75
MD5 hash:
aeab7ad90edf24bbd527a64ce1028404
SHA1 hash:
21ee0227244ab9cc2cb773fa0d7754a2397beee6
Link:
https://www.unpac.me/results/a8b5d9d5-e048-466b-abd8-4c8fdbd48cc3/
SH256 hash:
1ad0d504c0eadab3b4958eda4655ea158ffe03b47886f5a112620a37aaa17260
MD5 hash:
53e766a1a124f5d7300c211e092986ef
SHA1 hash:
948962914af90eff9f646c85d5e4437ee4f37c3e
Link:
https://www.unpac.me/results/a8b5d9d5-e048-466b-abd8-4c8fdbd48cc3/
SH256 hash:
25261db3376ea5f708e44e57a2ddd357696b09c9636483923204a2baf7f7403b
MD5 hash:
8a65c4ba30a650100527b8423bd14cb8
SHA1 hash:
73416dec1b6d45f56365e061a15b1dcd2af96841
Link:
https://www.unpac.me/results/a8b5d9d5-e048-466b-abd8-4c8fdbd48cc3/
SH256 hash:
c30394cfaa86ed8914e8becae2ee94bdd476d6aee6b840ed08eed379bc66f6b9
MD5 hash:
5787e5df1a68e7afea82d58e5f0d6549
SHA1 hash:
85aeb78ccb38d2b711f7c8c66b9c30f58e8b75d4
Link:
https://www.unpac.me/results/a8b5d9d5-e048-466b-abd8-4c8fdbd48cc3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02414d1572729bf910a4d7c45a0d391bf0559f68d4cbafd8cb5c070cd1d21b4b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dcrat_
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked dcrat malware samples.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/16333/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipAlloc
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::AttachConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW

Comments