MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0ec3487f79cb0fc47ea70ce3f93b13bb3013e54cd65c2e9b3c83c4663652321f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 11
| SHA256 hash: | 0ec3487f79cb0fc47ea70ce3f93b13bb3013e54cd65c2e9b3c83c4663652321f |
|---|---|
| SHA3-384 hash: | 173362f75f99d79d38155fa15d00413f171541b7fd8b0d03ac6c83f79962cef8f13128192428b149852955a79376206d |
| SHA1 hash: | ee1089ea700471032c96531f52316c359ee2e696 |
| MD5 hash: | e055e41b4fcfae545c51506fa16d4085 |
| humanhash: | march-helium-quebec-glucose |
| File name: | 0ec3487f79cb0fc47ea70ce3f93b13bb3013e54cd65c2e9b3c83c4663652321f.exe |
| Download: | download sample |
| File size: | 3'041'280 bytes |
| First seen: | 2026-09-01 04:52:22 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5a2ed47d8c6c6433dbc831d38c92042b |
| ssdeep | 49152:/3VoV1Q8nE6+a9iD4KYDVyJv+CZXG+Eoi+IQywxoE9nLOf6OuEm3wHFiyr/Vkfvr:yV1QMETfcDsdZcrwGwn0Vrqwljrm5s |
| TLSH | T194E52354BDC67BB2E07AC3BB42E3A0BE3129378589A44C9D37896B113E639183D77345 |
| TrID | 33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| Reporter |  whack_sh |
| Tags: | exe whack.sh |
Intelligence
File Origin
# of uploads :
1
# of downloads :
182
Origin country :
USVendor Threat Intelligence
Malware family:
phorpiex
ID:
1
File name:
almost there.zip
Verdict:
Malicious activity
Analysis date:
2026-09-01 02:03:50 UTC
Tags:
auto generic metasploit framework python processhacker tool kprocesshacker-sys vuln-driver pyinstaller solaris loader evasion phorpiex botnet stealer svcstealer stealc screenconnect remote github rmm-tool xmrig miner phishing powershell telegram arcticagent rat asyncrat maskgramstealer maskgram njrat remcos remusstealer nemucod rustystealer tinynuke amadey xworm clickfix bladabindi possible-phishing acr action1rmm advancedinstaller havoc vidar autoit openssl koiloader pushware adware lumma cryptowall ransomware datto remus ip-check websocket cryptolocker wannacry networm amus coinminer phantom putty deerstealer pastebin susp-powershell cobaltstrike winring0-sys gh0st guloader donutloader redline ftp pikabot meterpreter quasar arch-scr eicar-test noescape wiper golang
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Searching for synchronization primitives
Setting an event handler
DNS request
Moving of the original file
Setting a global event handler for the keyboard
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-08-31T23:30:00Z UTC
Last seen:
2026-09-02T18:00:00Z UTC
Hits:
~10
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Threat name:
Win64.Trojan.Malgent
Status:
Malicious
First seen:
2026-09-01 04:53:25 UTC
File Type:
PE+ (Exe)
AV detection:
19 of 24 (79.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
execution persistence spyware stealer
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: RenamesItself
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
0ec3487f79cb0fc47ea70ce3f93b13bb3013e54cd65c2e9b3c83c4663652321f
MD5 hash:
e055e41b4fcfae545c51506fa16d4085
SHA1 hash:
ee1089ea700471032c96531f52316c359ee2e696
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments |
| Reference: | https://cyfare.net/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 0ec3487f79cb0fc47ea70ce3f93b13bb3013e54cd65c2e9b3c83c4663652321f
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.