MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe
SHA3-384 hash: 16b3119159f426360657bdea6b091071013d1bb3fdf72271d77dcd795fbbb0f3ab3e78466e80746c0652b377a4c528f7
SHA1 hash: 6b7d86fa064ebd1b4c4d17cc1cbfb5b54bb3e9e4
MD5 hash: 38e7825de04bbc9621156431efbec8c8
humanhash: november-winner-romeo-december
File name:08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe
Download: download sample
File size:3'491'840 bytes
First seen:2026-08-10 14:55:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c77b89cd344508d2ca812dd1c349c70 (2 x ACRStealer, 1 x Rhadamanthys, 1 x LummaStealer)
ssdeep 49152:XPJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvzlzlneJejyw0Fq:BwSi0b67zeCzt0+yO3kSh1wJejyw
TLSH T145F57C27F7887D3ED46B0B364A37C690983BB7627A128D5767F00D0C8E355942E3EA46
TrID 87.7% (.EXE) Inno Setup installer (107240/4/30)
5.3% (.EXE) Win64 Executable (generic) (6522/11/2)
3.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.6% (.EXE) Generic Win/DOS Executable (2002/3)
1.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 79706ae9dcdc5c71
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug babar embarcadero_delphi fingerprint installer-heuristic keylogger overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6a79e6a52b1816fd61bc28fe/reports/456f00f1-3f51-4947-a1fd-4048dad1942c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-28T03:12:00Z UTC
Last seen:
2026-08-10T09:50:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe/results?tab=lookup
Gathering data
Score:
71%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe/
Threat name:
Win32.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2026-07-28 17:20:00 UTC
File Type:
PE (Exe)
Extracted files:
29
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bd227sq2wmzz22qhwioyxnu5sr3vllja5xpnp56lhdpiwm3ogx7a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/260810-snhspa1gqe/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe
MD5 hash:
38e7825de04bbc9621156431efbec8c8
SHA1 hash:
6b7d86fa064ebd1b4c4d17cc1cbfb5b54bb3e9e4
Link:
https://www.unpac.me/results/a74ff2df-c314-4a7f-bf07-2482032c0169/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/a74ff2df-c314-4a7f-bf07-2482032c0169/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TH_APT_EquationGroup_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Equation Group (G0020) APT malware detection - covers EquationDrug, GrayFish, DoubleFantasy, TripleFantasy, Fanny, GROK, nls_933w HDD firmware module, and Shadow Brokers tooling
Reference:https://cyfare.net/
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/80084/

Comments