MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 12
| SHA256 hash: | 03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b |
|---|---|
| SHA3-384 hash: | b62e1dd6cac613de379afea9af9e8fef5a6b7d94799e5a125c6f89ca5836f26020ce543e7fd74aa3834bf7b621257132 |
| SHA1 hash: | 014ee46292e7a949a21aa29ba11318e099ec1d50 |
| MD5 hash: | f6e195d0b763235a06093d8013b1d5dc |
| humanhash: | glucose-comet-tango-paris |
| File name: | SecuriteInfo.com.Trojan.DownLoader48.40278.20607.10242 |
| Download: | download sample |
| File size: | 36'352 bytes |
| First seen: | 2026-10-08 08:39:13 UTC |
| Last seen: | 2026-10-08 09:43:07 UTC |
| File type: |  exe |
| MIME type: | application/vnd.microsoft.portable-executable |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'249 x AgentTesla, 20'551 x Formbook, 12'385 x SnakeKeylogger) |
| ssdeep | 768:/pmQZqx1lYcJnqnaFFzvI/PLX8K3omDe0XbOfC11kqtY:x0lYovIbXr3omCMbO/qtY |
| TLSH | T116F26D58EBACD41ED65F0E7C24720A21127197525613DB99ADCC28FFECA73408B25BCB |
| TrID | 69.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win64 Executable (generic) (6522/11/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| Reporter |  SecuriteInfoCom |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
175
Origin country :
FRVendor Threat Intelligence
Malware configuration found for:
PS2EXE
Details
Malware family:
n/a
ID:
1
File name:
https://github.com/deriooo/SkriptGG/commit/5d8e7a06c291115cfc39a7b5758888f2082c32e7#diff-7b763868cbdb4b8608f33e33d8168f77b0f29d345b7e62ea6331a5dff6c0f1ba
Verdict:
Malicious activity
Analysis date:
2025-03-31 12:06:36 UTC
Tags:
github telegram lumma stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Deleting a recently created file
Launching a process
Creating a process with a hidden window
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 dropper packed powershell ps2exe
Verdict:
Malicious
Labled as:
Trojan.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-03-21T13:54:00Z UTC
Last seen:
2026-10-09T20:36:00Z UTC
Hits:
~100
Verdict:
Malicious
Score:
97%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.34 Win 32 Exe x86
Threat name:
ByteCode-MSIL.Infostealer.Limitail
Status:
Malicious
First seen:
2025-03-21 00:38:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
27 of 36 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
ADMINTOOL_PS2EXE
Result
Malware family:
n/a
Score:
8/10
Tags:
defense_evasion
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Obfuscated Files or Information: Command Obfuscation
Badlisted process makes network request
Unpacked files
SH256 hash:
03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b
MD5 hash:
f6e195d0b763235a06093d8013b1d5dc
SHA1 hash:
014ee46292e7a949a21aa29ba11318e099ec1d50
Detections:
SUSP_PS1_JAB_Pattern_Jun22_1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.