MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976
SHA3-384 hash: 7d66dc87e9e8302cdade889b2814ab5f330c562db100a1425387747135c1fe03451c5b2c890fbae71bf3f9c385c028eb
SHA1 hash: 833a4f4511df76fe92a7ad80961b346e9e2273bf
MD5 hash: 1b75879982a719a41f912cbb208da95c
humanhash: arkansas-delaware-apart-juliet
File name:client.exe
Download: download sample
File size:6'590'464 bytes
First seen:2026-07-13 17:23:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e1746c6965a6d5005de53ba4f2a07758
ssdeep 196608:plvt5OsD1GNuAQ9Nc3wt9Gx7CmC8scTBmYyeDZ4QieF4rwu1qm:pb5V1drc372ym
TLSH T12466D019D29350FCC67FC6718A1BB233FA60B42D5630A92E5B44DF786E15EA01E1DF28
TrID 40.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.0% (.EXE) Win64 Executable (generic) (6522/11/2)
12.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.0% (.EXE) Win32 Executable (generic) (4504/4/1)
5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74489/
Verdict:
Clean
Score:
N/A%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a551f5d3d3a766c4391b560
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing the Zone.Identifier stream
Сreating synchronization primitives
Creating a window
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Connection attempt
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Enabling autorun
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm anti-vm base64 cmd crypto evasive fingerprint keylogger lolbin onedrivestandaloneupdater packed reconnaissance schtasks
Link:
https://www.filescan.io/uploads/6a551f4e25999b52c41fefe6/reports/e7bf8f9e-1181-4119-a635-2949a2fbe551/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976
Verdict:
Clean
File Type:
exe x64
Link:
https://opentip.kaspersky.com/03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c9340f39-1b77-40b0-b224-515f7cf4d96c
Result
Threat name:
n/a
Detection:
malicious
Classification:
adwa.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1941693
Signature
Checks if the current machine is a virtual machine (disk enumeration)
Creates an undocumented autostart registry key
Drops PE files to the startup folder
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1941693 Sample: client.exe Startdate: 13/07/2026 Architecture: WINDOWS Score: 100 98 Multi AV Scanner detection for dropped file 2->98 100 Multi AV Scanner detection for submitted file 2->100 102 Sigma detected: Invoke-Obfuscation CLIP+ Launcher 2->102 104 3 other signatures 2->104 10 client.exe 3 8 2->10         started        14 ThemeMonitor.exe 2->14         started        16 ThemeMonitor.exe 2->16         started        process3 file4 88 C:\Users\user\AppData\...\OneDriveAaawat.exe, PE32+ 10->88 dropped 90 C:\Users\user\AppData\...\ThemeMonitor.exe, PE32+ 10->90 dropped 92 C:\Users\user\...\client.exe:Zone.Identifier, ASCII 10->92 dropped 94 C:\Users\...\ThemeMonitor.exe:Zone.Identifier, ASCII 10->94 dropped 116 Creates an undocumented autostart registry key 10->116 118 Drops PE files to the startup folder 10->118 120 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->120 126 2 other signatures 10->126 18 ThemeMonitor.exe 5 10->18         started        22 cmd.exe 1 10->22         started        24 cmd.exe 1 10->24         started        28 4 other processes 10->28 122 Multi AV Scanner detection for dropped file 14->122 124 Tries to detect virtualization through RDTSC time measurements 14->124 26 Conhost.exe 14->26         started        signatures5 process6 dnsIp7 96 104.239.83.200, 49700, 80 HOSTABILTR Turkey 18->96 106 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 18->106 108 Checks if the current machine is a virtual machine (disk enumeration) 18->108 110 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->110 30 cmd.exe 18->30         started        32 cmd.exe 18->32         started        34 cmd.exe 18->34         started        40 20 other processes 18->40 112 Uses schtasks.exe or at.exe to add and modify task schedules 22->112 114 Potential Privilege Escalation using Task Scheduler highest RunLevel 22->114 42 2 other processes 22->42 36 conhost.exe 24->36         started        38 WMIC.exe 1 24->38         started        44 2 other processes 26->44 46 9 other processes 28->46 signatures8 process9 process10 56 5 other processes 30->56 48 schtasks.exe 32->48         started        50 conhost.exe 32->50         started        58 3 other processes 34->58 60 2 other processes 36->60 52 conhost.exe 40->52         started        54 WMIC.exe 1 40->54         started        62 38 other processes 40->62 64 3 other processes 46->64 process11 66 Conhost.exe 48->66         started        68 Conhost.exe 50->68         started        74 3 other processes 52->74 76 2 other processes 54->76 78 2 other processes 56->78 80 2 other processes 58->80 70 Conhost.exe 60->70         started        72 Conhost.exe 62->72         started        82 7 other processes 62->82 process12 84 Conhost.exe 66->84         started        86 Conhost.exe 72->86         started       
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/1b75879982a719a41f912cbb208da95c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976/
Threat name:
Win64.Trojan.Doina
Create hunting rule
Status:
Malicious
First seen:
2026-07-13 17:24:40 UTC
File Type:
PE+ (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ao4v3fragx4jlgcpdqtcybt7rgzqopghd3agf5j3crqkvgkpff3a._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion
Link:
https://tria.ge/reports/260713-vykq5scx8j/
Behaviour
Enumerates system info in registry
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Subvert Trust Controls: Mark-of-the-Web Bypass
Looks for VMWare Tools registry key
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976
MD5 hash:
1b75879982a719a41f912cbb208da95c
SHA1 hash:
833a4f4511df76fe92a7ad80961b346e9e2273bf
Link:
https://www.unpac.me/results/648eccbb-83b9-487f-9159-c7ff25e0e131/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Avaddon
Create hunting rule
Author:@bartblaze
Description:Identifies Avaddon ransomware.
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:Check_Wine
Create hunting rule
Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 03b95d962035f895984f1c262c067f89b3073cc71ec062f53b1460aa994f2976

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3885914/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/74489/

Comments