🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lazarus


Vendor detections: 12


Intelligence 12 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e
SHA3-384 hash: da02bc95f9ad279114da5f252113d8e0b0bc7adc74c0a7bf9a8c0bf9f4b220d871f6c7fdf05ecef57df23acbb3377977
SHA1 hash: 186f448b56678a3ca845bb204c2cf92a881af607
MD5 hash: aef67f5fa937282139975b13fe9211d7
humanhash: missouri-mobile-tennis-johnny
File name:0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e.bin
Download: download sample
Signature Lazarus
Create hunting rule
File size:164'864 bytes
First seen:2026-05-25 18:10:12 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f5fcb94000f27252fbd5a80e8c920956 (1 x Lazarus)
ssdeep 3072:Hi+55tjGsE4vj1WyICl5XLD9rhlszmHqCRciHaApJY:Hi8y61WyICJD9dJ6Apq
TLSH T1D8F37C01F180C075D4BA243C16BD93A1297C7A301B955ACFB7E51E6A2FB81C1B73AE67
TrID 42.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.8% (.EXE) Win64 Executable (generic) (6522/11/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4504/4/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter KodaDr
Tags:BANKSHOT dll HiddenCobra Lazarus

Intelligence

File Origin
# of uploads :
1
# of downloads :
300
Origin country :
RU RU
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/67868/
Detection(s):
SecuriteInfo.com.Variant.Jaik.64887.14930.623.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a1490b25d76862ef947bc22
Tags:
manuscrypt shellcode dropper virus
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug masquerade microsoft_visual_cc
Link:
https://www.filescan.io/uploads/6a1490a8861ee596e64b210a/reports/0e2c0859-09c5-473a-9911-d59a92543ba7/overview
Verdict:
Malicious
Labled as:
Trojan.1388FEAC
Link:
https://www.hybrid-analysis.com/sample/0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e
Verdict:
Malicious
File Type:
dll x32
First seen:
2017-10-17T10:06:00Z UTC
Last seen:
2026-05-27T00:32:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e/results?tab=lookup
Malware family:
CopperHedge
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9fe2f656-0f63-499a-bfbb-37a68cd5509e
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/aef67f5fa937282139975b13fe9211d7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e/
Threat name:
Win32.Trojan.HiddenCobra
Create hunting rule
Status:
Malicious
First seen:
2017-10-18 00:42:50 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
31 of 36 (86.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bif5nfxmbwmlnxd4wzk24wbxbvgrh4elsgus532sudwr565yk57a._file
Verdict:
malicious
Label(s):
bankshot
Create hunting rule
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery
Link:
https://tria.ge/reports/260525-wsgb7sgz8v/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Badlisted process makes network request
Unpacked files
SH256 hash:
0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e
MD5 hash:
aef67f5fa937282139975b13fe9211d7
SHA1 hash:
186f448b56678a3ca845bb204c2cf92a881af607
Detections:
win_bankshot_auto
Create hunting rule
Link:
https://www.unpac.me/results/33b5d1bf-1fd1-449c-a937-d4231b4e98f7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HiddenCobra_BANKSHOT_Gen
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Hidden Cobra BANKSHOT trojan
Reference:https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
Rule name:HiddenCobra_BANKSHOT_Gen_RID2F76
Create hunting rule
Author:Florian Roth
Description:Detects Hidden Cobra BANKSHOT trojan
Reference:https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:TA17_318A_success_fail_codes_fallchill
Create hunting rule
Author:US CERT
Description:HiddenCobra FallChill - success_fail_codes
Reference:https://www.us-cert.gov/ncas/alerts/TA17-318B
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/67868/

Comments