🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SilentNet


Vendor detections: 14


Intelligence 14 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a
SHA3-384 hash: 0a5cdd7fd0bcabe3fce4d1338858cc38bbb3b900a514019f7f9f2b3dd114f0a8d82d1ffc9484aabbe44e3dcdc46761dc
SHA1 hash: 81bf1826d3bc5c17fb064f362ae8e3034ebaea90
MD5 hash: 926b25b2e1bdf55385d6c606433d97e4
humanhash: twelve-floor-oranges-gee
File name:0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a.exe
Download: download sample
Signature SilentNet
Create hunting rule
File size:1'138'688 bytes
First seen:2026-11-07 01:17:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 73f461c771aef77ec43d53a0c54f0c8d (54 x SilentNet, 1 x CoinMiner)
ssdeep 12288:YZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGXvPqItNquB:Ycb4M06WpoPrwIvP3f5
TLSH T1C4357C83EBE381D8C156C8B5535BF137F9627C8E4A157196ABC41E633E67B64E22CB00
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter Tuxxin
Tags:exe SilentNet

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-07 02:07:03 UTC
Tags:
silentnet stealer python arch-exec arch-doc openssl tool arch-scr
Link:
https://app.any.run/tasks/84cceaca-4721-458b-bd49-2b655081eed9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97855/
Detection(s):
SecuriteInfo.com.Generic.Dacic.11262.17A487CB.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1bb731492c978625a4204
Tags:
virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto downloader loader reconnaissance
Link:
https://www.filescan.io/uploads/6aee7c8b1ec904be2f5be586/reports/a2c5881f-8bf9-4ebe-96e0-9850cbf12daf/overview
Verdict:
Malicious
Labled as:
Win64/Agent_AGeneric.MCC trojan
Link:
https://www.hybrid-analysis.com/sample/0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-06-04T00:10:00Z UTC
Last seen:
2026-09-07T14:04:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d34971d6-790c-4cac-bba6-d62e25f44b06
Result
Threat name:
EtherHiding
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2000279
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious ZIP file
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Writes many files with high entropy
Writes to foreign memory regions
Yara detected EtherHiding
Yara detected Python Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2000279 Sample: LqEZga4unw.exe Startdate: 07/11/2026 Architecture: WINDOWS Score: 100 108 thisisafalsepositive.st 2->108 110 rpc-mainnet.matic.quiknode.pro 2->110 112 8 other IPs or domains 2->112 146 Suricata IDS alerts for network traffic 2->146 148 Antivirus / Scanner detection for submitted sample 2->148 150 Multi AV Scanner detection for submitted file 2->150 152 6 other signatures 2->152 10 LqEZga4unw.exe 4 2->10         started        signatures3 process4 dnsIp5 114 rpc-mainnet.matic.quiknode.pro 64.31.48.194, 443, 49702, 49738 LIMESTONENETWORKS-LimestoneNetworksIncUS Japan 10->114 116 polygon-rpc.com 198.178.224.35, 443, 49699, 49736 LATITUDE-SH-LatitudeshUS United States 10->116 158 Found direct / indirect Syscall (likely to bypass EDR) 10->158 14 python.exe 10->14         started        19 python.exe 1272 10->19         started        21 python.exe 10->21         started        23 6 other processes 10->23 signatures6 process7 dnsIp8 118 151.101.0.175, 443, 49748 FASTLY-FastlyIncUS Canada 14->118 120 cloudflare-dns.com 104.16.248.249, 443, 49735, 49737 CLOUDFLARENET-CloudflareIncUS Canada 14->120 88 C:\Users\user\AppData\Local\...\python.exe, PE32+ 14->88 dropped 98 36 other files (3 malicious) 14->98 dropped 134 Tries to harvest and steal browser information (history, passwords, etc) 14->134 136 Writes to foreign memory regions 14->136 138 Allocates memory in foreign processes 14->138 140 Creates a thread in another existing process (thread injection) 14->140 25 python.exe 14->25         started        29 pip.exe 14->29         started        31 python.exe 14->31         started        34 chrome.exe 14->34         started        122 151.101.0.223, 443, 49720, 49726 FASTLY-FastlyIncUS Canada 19->122 124 pypi.org 151.101.128.223, 443, 49719, 49725 FASTLY-FastlyIncUS Canada 19->124 100 492 other files (none is malicious) 19->100 dropped 142 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->142 144 Writes many files with high entropy 19->144 36 conhost.exe 19->36         started        90 C:\Users\user\AppData\Local\...\tmpw61ofvwq, Zip 21->90 dropped 92 C:\Users\user\AppData\Local\...\tmpviop5ilg, Zip 21->92 dropped 94 C:\Users\user\AppData\Local\...\tmpv9_g3gt1, Zip 21->94 dropped 102 314 other files (9 malicious) 21->102 dropped 38 conhost.exe 21->38         started        126 thisisafalsepositive.st 185.178.208.191, 443, 49723, 49730 DDOS-GUARDRU Russia 23->126 128 dualstack.c.ssl.global.fastly.net 151.101.128.175, 443, 49712 FASTLY-FastlyIncUS Canada 23->128 130 2 other IPs or domains 23->130 96 C:\Users\user\AppData\Local\...\python.exe, PE32+ 23->96 dropped 104 33 other files (2 malicious) 23->104 dropped 40 conhost.exe 23->40         started        42 conhost.exe 23->42         started        44 4 other processes 23->44 file9 signatures10 process11 dnsIp12 72 C:\Users\user\AppData\Local\Temp\...\wait.py, Python 25->72 dropped 74 C:\Users\user\AppData\Local\Temp\...\util.py, Python 25->74 dropped 76 C:\Users\user\AppData\Local\Temp\...\url.py, Python 25->76 dropped 84 684 other files (none is malicious) 25->84 dropped 154 Suspicious powershell command line found 25->154 156 Adds a directory exclusion to Windows Defender 25->156 46 conhost.exe 25->46         started        48 python.exe 29->48         started        52 conhost.exe 29->52         started        132 208.91.109.46 TERASWITCH-TeraSwitchNetworksIncUS Japan 31->132 78 C:\Users\user\AppData\Local\...\stdole.py, Python 31->78 dropped 80 _78530B68_61F9_11D...A024580902_0_1_0.py, Python 31->80 dropped 82 _56A868B0_0AD4_11C...20AF0BA770_0_1_0.py, Python 31->82 dropped 86 3 other files (none is malicious) 31->86 dropped 54 powershell.exe 31->54         started        56 powershell.exe 31->56         started        58 conhost.exe 31->58         started        file13 signatures14 process15 dnsIp16 106 151.101.192.223, 443, 49761 FASTLY-FastlyIncUS Canada 48->106 64 C:\Users\user\AppData\Local\...\axscript.pyd, PE32+ 48->64 dropped 66 C:\Users\user\AppData\...\scriptdispatch.py, Python 48->66 dropped 68 C:\Users\user\AppData\...\pyscript_rexec.py, Python 48->68 dropped 70 565 other files (none is malicious) 48->70 dropped 60 conhost.exe 54->60         started        62 conhost.exe 56->62         started        file17 process18
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/926b25b2e1bdf55385d6c606433d97e4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a/
Threat name:
Win64.Trojan.Convagent
Create hunting rule
Status:
Malicious
First seen:
2026-06-05 03:23:31 UTC
File Type:
PE+ (Exe)
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b2rivfjgq2jghgo42anz5dixypb7pmv6tuzamn5ml3qhztr7q5fa._file
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig defense_evasion discovery execution miner persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/261107-bn1vtsvtft/
Behaviour
Checks processor information in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
cURL User-Agent
Browser Information Discovery
Event Triggered Execution: Netsh Helper DLL
Reads the TCP/IP host and domain name from the registry
Drops file in Windows directory
Drops file in System32 directory
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Modifies Windows Firewall
XMRig Miner payload
Family: xmrig
Malware Family:
n/a
Verdict:
Malicious
Tags:
loader
YARA:
n/a
Link:
https://app.threat.zone/submission/884b0055-e219-4c9c-ae54-a5eb1321aba9
Malware Family:
dacic
Create hunting rule
Malicious:
True
Tags:
64bits executes-dropped-file checks-cpu-name
Link:
https://intel.virussign.com/intelligence/file/0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a
Unpacked files
SH256 hash:
0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a
MD5 hash:
926b25b2e1bdf55385d6c606433d97e4
SHA1 hash:
81bf1826d3bc5c17fb064f362ae8e3034ebaea90
Link:
https://www.unpac.me/results/193dcb7a-6726-4cad-8e43-745e3a4cc1b9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:data_manipulation
Create hunting rule
Author:Serhii Kocherhan
Description:Detects data manipulation routines including XOR encoding, Base64 references, and RC4 PRGA encryption
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:SilentNet_Nuitka_Stage
Create hunting rule
Author:GhostTypes
Description:SilentNet exe/bin channel, two lanes: (A) Zig AppHost downloader - std.http client with custom UA template plus registry/env/process import combo and Zig .CRT/.tls section pair; (B) Nuitka-Commercial DataHiding pyd stage - DLL whose RT_RCDATA#3 blob declares a size ending exactly 24 bytes before the resource end (the MD5-digest trailer of the commercial blob framing; stock Nuitka has no trailer, onefile builds have no RCDATA)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:VIGIA_SilentNet_0e73fcdc
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:dc75f6ad-fcce-402e-af18-74cd73e4565a - SilentNet candidate detection
Reference:https://vigia.bisite.es/
Rule name:VIGIA_SilentNet_59fd2415
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:c495aa95-aee7-4a2d-a80a-1ed5e722a843 - SilentNet HTTP templates and corroborated runtime indicators
Reference:https://vigia.bisite.es/
Rule name:VIGIA_SilentNet_f7408dfb
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:42613b14-3008-48bf-b427-29aaa05c17eb - file b13b22c66cd105a2e5a10bbc9339bfa0e4f4cb1faa4cd2d0a7ae854948d2b1c5.exe
Reference:https://vigia.bisite.es/
Rule name:WARDEN_Stealer_Family
Create hunting rule
Author:Rony
Description:Warden Stealer, any build (x64 DLL or EXE): the stack-built stub for its remote CryptUnprotectMemory call, or its SHA-256-keystream C2 message cipher
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentNet

Executable exe 0ea28a952686926399dcd01b9e8d17c3c3f7b2be9d320637ac5ee07cce3f874a

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4058187/
Cape
Cape
https://www.capesandbox.com/analysis/97855/

Comments