🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cceb3eb88916dfcf5e7cdef4eab8a74d42bc1bd38d842472dee97c9861bb8ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 15


Intelligence 15 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0cceb3eb88916dfcf5e7cdef4eab8a74d42bc1bd38d842472dee97c9861bb8ad
SHA3-384 hash: 7b64029865d23476250519c2049233efd75ee633145c5c329f98374d0adb3ff9785d593608d754bc0bb9566ac7beaa78
SHA1 hash: 032ef101c369e30465a56ce5a84e750deec773a1
MD5 hash: 87fa4830e4e7cebaacf2e96f348ca072
humanhash: batman-comet-iowa-beryllium
File name:87fa4830e4e7cebaacf2e96f348ca072.exe
Download: download sample
File size:4'081'664 bytes
First seen:2026-11-04 11:18:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'322 x AgentTesla, 20'747 x Formbook, 12'407 x SnakeKeylogger)
ssdeep 49152:UAFgqUuiMG9kdren++su6V/y2P/6JzJdf/waogh8uyjvnP0qoKuImPzrS:D6AasVPy9nnwaogh8Drm
TLSH T1F61609487650758EC61FCE72A9D45C64EE607CAF4707F20B6C933AEC593D58ACFA40A2
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b671f0f4d4d2e2e5
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
205
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
ConfuserEx RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/bec588c1-1800-4d27-a810-b241d8cca2b8/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-04 12:17:56 UTC
Tags:
confuser wmi-base64
Link:
https://app.any.run/tasks/4fbac51f-ce76-4adf-afc8-7b7d85f19aa7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97188/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.278177.24731963.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aeb14c43970fcef1e4b0761
Tags:
obfuscate dropper crypted
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Deleting a recently created file
Creating a file in the %temp% subdirectories
Creating synchronization primitives
Moving a recently created file
Launching a process
Connection attempt
Sending a custom TCP request
Setting a keyboard event handler
Running batch commands
Replacing files
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/0cceb3eb88916dfcf5e7cdef4eab8a74d42bc1bd38d842472dee97c9861bb8ad
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-30T01:48:00Z UTC
Last seen:
2026-11-05T05:46:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0cceb3eb88916dfcf5e7cdef4eab8a74d42bc1bd38d842472dee97c9861bb8ad/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2d4a146b-d9a6-499f-9acb-d0f642ed0a9a
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1998169
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0cceb3eb88916dfcf5e7cdef4eab8a74d42bc1bd38d842472dee97c9861bb8ad
Verdict:
inconclusive
YARA:
14 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.98 Win 32 Exe x86
Link:
https://app.malva.re/file/87fa4830e4e7cebaacf2e96f348ca072
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0cceb3eb88916dfcf5e7cdef4eab8a74d42bc1bd38d842472dee97c9861bb8ad/
Threat name:
Win32.Trojan.AdvML
Create hunting rule
Status:
Malicious
First seen:
2026-11-01 04:41:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bthlh24isfw7z5phzxxu5k4kotkcxqn5hdmeerzn52l4tbq3xcwq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution
Link:
https://tria.ge/reports/261104-nexs2abz2q/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
ConfuserEx .NET packer
Checks installed software on the system
Obfuscated Files or Information: Command Obfuscation
Command and Scripting Interpreter: PowerShell
Malware Family:
n/a
Verdict:
Malicious
Tags:
stealer evasion
YARA:
win_hook UNPROTECT_disable_process KeyloggerApi SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Link:
https://app.threat.zone/submission/5f3934f8-b4db-48b4-99d0-d7ca6884d6a3
Malware Family:
msilheracles
Create hunting rule
Malicious:
True
Tags:
dotnet checks-user-input calls-wmi macro-powershell obfuscated crypto checks-network-adapters long-sleeps detect-debug-environment
Source:
https://www.virussign.com/
Unpacked files
SH256 hash:
0cceb3eb88916dfcf5e7cdef4eab8a74d42bc1bd38d842472dee97c9861bb8ad
MD5 hash:
87fa4830e4e7cebaacf2e96f348ca072
SHA1 hash:
032ef101c369e30465a56ce5a84e750deec773a1
Detections:
INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6de5840a-1004-4337-b079-05dcfc64459a/
SH256 hash:
262b64bff0cafa96204dd53ae89cecc1aadd3d8a6b31ccee4924646f87cb3768
MD5 hash:
4b0884755d88cb3b39288d278eb11a30
SHA1 hash:
105a860d2328c341dfb9046284e77ee20e63228a
Link:
https://www.unpac.me/results/6de5840a-1004-4337-b079-05dcfc64459a/
SH256 hash:
a079ac4933606d5219bb27e3ca73d3d03d1990db2dfd4770168853baff28e284
MD5 hash:
daee36a13fad6ca1f61d575722a6de13
SHA1 hash:
20d441667614d2e1a3ad3e2ec22db8afe38e0413
Link:
https://www.unpac.me/results/6de5840a-1004-4337-b079-05dcfc64459a/
SH256 hash:
ef536b1de7d76b7d116c8ecfa40216abf6c54198f7f7632b90bf97c2afd4d139
MD5 hash:
6196f1b20bfdc9c7d1e6d383e600a49c
SHA1 hash:
7f5ef225e62fce8be0b2b39604737cdea6cbbb42
Link:
https://www.unpac.me/results/6de5840a-1004-4337-b079-05dcfc64459a/
SH256 hash:
663bf73c4edc6558e47126b6da86d3c643d5b6ed74fcd70255b8004ce5022e1e
MD5 hash:
56dfaa5e36a20883309f2fcf3036f338
SHA1 hash:
a8977a4256c5ee4adf622ab6656314b5bc1674c2
Link:
https://www.unpac.me/results/6de5840a-1004-4337-b079-05dcfc64459a/
SH256 hash:
69cd22a25396e8ad63f93beebce01e20b5c7696cf937fd04c9a847617f18f87b
MD5 hash:
7bde0622004c1a8d3826f75b7e131597
SHA1 hash:
d7244b3542e028045b2b80518024a6b3608f8ac5
Link:
https://www.unpac.me/results/6de5840a-1004-4337-b079-05dcfc64459a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/97188/

Comments