🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e
SHA3-384 hash: 55ca9e1ae01ab1b110d254170f645aa6859c0aa2aa48d404dbba089ef3856214c6c47bd3c4559774b7db5663288ed618
SHA1 hash: 99d6587dea2d75c8e1c819a8c24927f792b210e8
MD5 hash: 07db2549f2299c26094b425c87648fd9
humanhash: california-iowa-mexico-item
File name:0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e.exe
Download: download sample
File size:4'310'119 bytes
First seen:2026-10-04 08:35:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 88016fcdef7f227c62171d0afad9aae4 (31 x ValleyRAT, 23 x Adware.OfferCore, 21 x OffLoader)
ssdeep 98304:B5OQZPNt3vXPxWnMMq3PsLTFEdkNAIjjXzEhcX4R:7pXt3vXPWMMC85TN5LEh7R
TLSH T1F716023FB28B613EF06E5A353AB2A210583BA66165138C56D6F4C88CCF251711E3F797
TrID 61.4% (.EXE) Inno Setup installer (107240/4/30)
23.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.7% (.EXE) Win64 Executable (generic) (6522/11/2)
2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 96f0c8cccc693296
Reporter Tuxxin
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
193
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/98d3d148-159e-48f6-8534-0e232687e8fc/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-04 08:43:04 UTC
Tags:
delphi inno installer evasion rdp
Link:
https://app.any.run/tasks/37a4b2c9-d1f5-45b6-a8da-a616968880da

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/90593/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acf470b6f551121ba1500c5
Tags:
dropper delphi shell sage
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e
Verdict:
Unknown
File Type:
exe x32
First seen:
2026-10-04T06:07:00Z UTC
Last seen:
2026-10-05T09:47:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d3d37613-bfef-41bd-af51-7e07f3717611
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1981937
Signature
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious Script Execution From Temp Folder
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1981937 Sample: CRhgBfwLdP.exe Startdate: 04/10/2026 Architecture: WINDOWS Score: 52 96 secblitz.lol 2->96 102 Malicious sample detected (through community Yara rule) 2->102 104 Multi AV Scanner detection for submitted file 2->104 106 Encrypted powershell cmdline option found 2->106 108 6 other signatures 2->108 10 CRhgBfwLdP.exe 2 2->10         started        13 secblitz.exe 2->13         started        signatures3 process4 dnsIp5 92 C:\Users\user\AppData\...\CRhgBfwLdP.tmp, PE32 10->92 dropped 17 CRhgBfwLdP.tmp 23 17 10->17         started        98 secblitz.lol 104.21.52.199, 443, 49711 CLOUDFLARENET-CloudflareIncUS Canada 13->98 120 Found direct / indirect Syscall (likely to bypass EDR) 13->120 21 conhost.exe 13->21         started        file6 signatures7 process8 file9 70 C:\Program Files\...\secblitz.exe (copy), PE32+ 17->70 dropped 72 C:\Users\user\...\secblitz-maintenance.ps1, ASCII 17->72 dropped 74 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 17->74 dropped 76 3 other files (none is malicious) 17->76 dropped 100 Bypasses PowerShell execution policy 17->100 23 secblitz.exe 17->23         started        26 powershell.exe 35 17->26         started        29 powershell.exe 34 17->29         started        31 powershell.exe 17->31         started        signatures10 process11 file12 110 Encrypted powershell cmdline option found 23->110 112 Found direct / indirect Syscall (likely to bypass EDR) 23->112 33 powershell.exe 23->33         started        36 powershell.exe 23->36         started        50 19 other processes 23->50 94 C:\Users\user\AppData\...\hcb2bhia.cmdline, Unicode 26->94 dropped 114 Found suspicious powershell code related to unpacking or dynamic code loading 26->114 116 Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes) 26->116 118 Powershell drops PE file 26->118 38 csc.exe 3 26->38         started        40 conhost.exe 26->40         started        42 csc.exe 29->42         started        44 conhost.exe 29->44         started        46 csc.exe 31->46         started        48 conhost.exe 31->48         started        signatures13 process14 file15 78 C:\Windows\...\WimProvider.dll.mui, PE32 33->78 dropped 80 C:\Windows\...\VhdProvider.dll.mui, PE32 33->80 dropped 82 C:\Windows\...\UnattendProvider.dll.mui, PE32 33->82 dropped 90 97 other malicious files 33->90 dropped 52 conhost.exe 33->52         started        54 conhost.exe 36->54         started        84 C:\Users\user\AppData\Local\...\hcb2bhia.dll, PE32 38->84 dropped 56 cvtres.exe 1 38->56         started        86 C:\Users\user\AppData\Local\...\3tuq3xio.dll, PE32 42->86 dropped 58 cvtres.exe 42->58         started        88 C:\Users\user\AppData\Local\...\tlkeausi.dll, PE32 46->88 dropped 60 cvtres.exe 46->60         started        62 conhost.exe 50->62         started        64 conhost.exe 50->64         started        66 conhost.exe 50->66         started        68 15 other processes 50->68 process16
Score:
75%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/07db2549f2299c26094b425c87648fd9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-04 08:36:41 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
2 of 24 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bx2wpm3uppq5z5etuznzzc6thbou6zik5vpfkeyeifsa47irmvha._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery execution installer persistence
Link:
https://tria.ge/reports/261004-khqbkstepb/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Inno Setup is an open-source installation builder for Windows applications.
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Checks installed software on the system
Enumerates connected drives
Obfuscated Files or Information: Command Obfuscation
Executes dropped EXE
Unpacked files
SH256 hash:
0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e
MD5 hash:
07db2549f2299c26094b425c87648fd9
SHA1 hash:
99d6587dea2d75c8e1c819a8c24927f792b210e8
Link:
https://www.unpac.me/results/975a9dc7-8e64-4006-9d1e-72c8cd15d78b/
SH256 hash:
dd8a38dc5f0c7f607534386ba0ba0cf7cc8a7c881864bc67139803a856f3ed93
MD5 hash:
cdfdfa9c2df0cb57e27b1e31762b7e79
SHA1 hash:
6f93d154b058b19f65c6cf2d53c1a6f7549e3398
Link:
https://www.unpac.me/results/975a9dc7-8e64-4006-9d1e-72c8cd15d78b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 0df567b3747be1dcf493a65b9c8bd3385d4f650aed5e55130441640e7d11654e

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/90593/

Comments