MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b8af196cedf8528e113dffc2c15f2c0e70439f5f885c33d38f380d7af94fea2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 8 File information Comments

SHA256 hash:	0b8af196cedf8528e113dffc2c15f2c0e70439f5f885c33d38f380d7af94fea2
SHA3-384 hash:	eec8d53faf5bc12be9855f656f30f746af432dd28d7d407385356d27382e64241f58ab8c054d124d08532a1f1b0529e9
SHA1 hash:	46ec8621ff61235825c364059172f28cd2d43c33
MD5 hash:	2d20f7a6854af43e5b1ebc8b44f0f8d6
humanhash:	harry-ten-paris-xray
File name:	1.exe
Download:	download sample
File size:	29'760'737 bytes
First seen:	2026-05-27 11:22:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	dcaf48c1f10b0efa0a4472200f3850ed (716 x Efimer, 60 x BlankGrabber, 23 x SalatStealer)
ssdeep	786432:CquyW8mZW+e5RY2j6+s7LWB75zuPN/9Mk5thNTm:9uyW7W+eHY2qHWB75iVGkNNC
TLSH	T19E673398B7CE48B5F9A9917FD8904663A2A2787503B4C6CB8BF4491307D70CADF79324
TrID	70.9% (.EXE) InstallShield setup (43053/19/16) 10.7% (.EXE) Win64 Executable (generic) (6522/11/2) 8.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.3% (.EXE) OS/2 Executable (generic) (2029/13) 3.3% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	009aa2baaab2b244 (2 x njrat)
Reporter	BlinkzSec

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PyInstaller

Details

PyInstaller

a compiled assembly and a Python version

Link:

https://research.acce.ciphertechsolutions.com/results/debe775c-646b-4bb9-90ae-f3b74ed42b09/

Malware family:

n/a

ID:

File name:

_0b8af196cedf8528e113dffc2c15f2c0e70439f5f885c33d38f380d7af94fea2.exe

Verdict:

No threats detected

Analysis date:

2026-05-27 11:25:22 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9c3f98e5-bd32-4e02-af0a-11ef664c1c25

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/68159/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a16d4385b1db29f5a486706

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Restart of the analyzed sample

Creating a window

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Connection attempt

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/0b8af196cedf8528e113dffc2c15f2c0e70439f5f885c33d38f380d7af94fea2

Verdict:

Clean

File Type:

exe x64

Link:

https://opentip.kaspersky.com/0b8af196cedf8528e113dffc2c15f2c0e70439f5f885c33d38f380d7af94fea2/results?tab=lookup

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0b8af196cedf8528e113dffc2c15f2c0e70439f5f885c33d38f380d7af94fea2

Gathering data

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/0b8af196cedf8528e113dffc2c15f2c0e70439f5f885c33d38f380d7af94fea2

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-05-27 06:59:26 UTC

File Type:

PE+ (Exe)

Extracted files:

2016

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bofpdfwo36csryit376cyfpsydtqiopv7cc4gpjy6oanpl4u72ra._file

Result

Malware family:

n/a

Score:

7/10

Tags:

pyinstaller

Link:

https://tria.ge/reports/260527-nhfzpaew7w/

Behaviour

Suspicious use of WriteProcessMemory

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	dependsonpythonailib Create hunting rule
Author:	Tim Brown
Description:	Hunts for dependencies on Python AI libraries

Rule name:	Detect_PyInstaller Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PyInstaller compiled executables across platforms

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	PyInstaller Create hunting rule
Author:	@bartblaze
Description:	Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 0b8af196cedf8528e113dffc2c15f2c0e70439f5f885c33d38f380d7af94fea2

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3853871/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/68159/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample