MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0299d636802f5d8ce29683c1f5da0fa62b43f5cc905be187c3998b85c8749b42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureCrypter

Vendor detections: 7

Intelligence 7 IOCs YARA 9 File information Comments

SHA256 hash:	0299d636802f5d8ce29683c1f5da0fa62b43f5cc905be187c3998b85c8749b42
SHA3-384 hash:	18ff449f6f7b511f7742a6838c3108aa324926c4aa542b28f6629b4f3666f5678268e27af25cd54aeb7783a5cf89ab9d
SHA1 hash:	c5dd757eff677115edc100a5db3e52064894c015
MD5 hash:	465854517b1e404c4e1343abb8c02e55
humanhash:	angel-pizza-yankee-delaware
File name:	Installer.iso
Download:	download sample
Signature	PureCrypter Create hunting rule
File size:	19'902'464 bytes
First seen:	2026-03-31 12:30:00 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	393216:G+DpjRGxBk5wG4xdHCiS7r706rylaOKFeoJnOoMf9PVTOPzcZ98cj:G+eBk56nHAv0zadFeoJOoyPVTOoZ9H
TLSH	T1DB1733366DE213A1DD3C6830DA4FB4748A7DE81C291061416F5D3BBD47AE03E62CB7A9
TrID	88.7% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Magika	iso
Reporter	aachum
Tags:	iso purecrypter tabbysbakescodes-ws

iamaachum

https://dl89sfilesbase.top/downloads/X7hRw0kiN/AppSetup

C2: https://tabbysbakescodes.ws/CNB/gate.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	Installer_v2103_x64_.exe
File size:	19'848'704 bytes
SHA256 hash:	2ecfae6dbd7647ace5980e6ea59b9bdbf82253943fb437fc79c7e74fc30d6119
MD5 hash:	bdd5a7fb680fc4987d03d603aa9c7a78
MIME type:	application/x-dosexec
Signature	PureCrypter

File name:	ReadMe.txt
File size:	761 bytes
SHA256 hash:	8dac22f984bff8e1162b63065ed3b990b44fe9b7a2da940ca3a6053c202a1bc3
MD5 hash:	ff0400d5397036ff353727a5f9941455
MIME type:	text/plain
Signature	PureCrypter

Vendor Threat Intelligence

Gathering data

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cbbe706363ca5d27f0242d

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

crypt obfuscated packed packed soft-404 themidawinlicense xpack

Link:

https://www.filescan.io/uploads/69cbbe6be2df9aa488bfd7a0/reports/68622f85-117d-410c-8e68-a0033565a9c0/overview

Verdict:

Suspicious

Labled as:

W64/Themida.DH.gen

Link:

https://www.hybrid-analysis.com/sample/0299d636802f5d8ce29683c1f5da0fa62b43f5cc905be187c3998b85c8749b42

Verdict:

Malicious

File Type:

iso

First seen:

2026-03-31T10:13:00Z UTC

Last seen:

2026-03-31T10:24:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0299d636802f5d8ce29683c1f5da0fa62b43f5cc905be187c3998b85c8749b42/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/465854517b1e404c4e1343abb8c02e55

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0299d636802f5d8ce29683c1f5da0fa62b43f5cc905be187c3998b85c8749b42/

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/0299d636802f5d8ce29683c1f5da0fa62b43f5cc905be187c3998b85c8749b42

Threat name:

Win32.Trojan.Qwexlafiba

Status:

Malicious

First seen:

2026-03-31 12:30:43 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=akm5mnuaf5oyzyuwqpa7lwqpuyvuh5omsbn6db6dtgfylsdutnba._file

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion execution persistence themida trojan

Link:

https://tria.ge/reports/260331-qdz8wadx8v/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Looks up external IP address via web service

Checks BIOS information in registry

Executes dropped EXE

Themida packer

Command and Scripting Interpreter: PowerShell

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0299d636802f5d8ce29683c1f5da0fa62b43f5cc905be187c3998b85c8749b42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)