🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 136bd1fd0aca0ee18b15eec0f7e1076534ecfcadc1f94bad5e8716f1b2b565bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 136bd1fd0aca0ee18b15eec0f7e1076534ecfcadc1f94bad5e8716f1b2b565bd
SHA3-384 hash: 0c382a313637aa692b8193ed283dd813403e5a3e119220d02ec5e6778c5c8925cbc6e7162851ab04ae39da5f300976de
SHA1 hash: f1460419ecac8ce3c37cb2d0f5e34d214a97bbc6
MD5 hash: 2bee72134a427f4d901e39f945e67e1f
humanhash: lithium-shade-grey-triple
File name:rbxfix.exe
Download: download sample
File size:70'545'207 bytes
First seen:2026-10-28 17:12:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash e3e80a143805ea18936c8f612e25d363 (4 x Adware.Techsnab, 1 x PyhtonStealer, 1 x PythonStealer)
ssdeep 1572864:E4f/pu7Wc0XTHlwBXKxj8adoQuvG2uGPh/rfP6L0MmpM3S:Tfhu0LlsXWwadkvGxGZfPW0npn
TLSH T1FDF7339AAE8038FAF1FF40359C5B960DF6F5350D136A019B13B419BE1C9B2D91FB8612
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon c498e4c4d4608c60
Reporter Alex_sev
Tags:exe zapret

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
NL NL
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4a91d08c-643f-44b6-aebe-f834a92204d0/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-28 17:25:20 UTC
Tags:
python auto-startup pyinstaller
Link:
https://app.any.run/tasks/3fd11bb3-6f9f-4b8e-951f-12415f57014f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae22d3449621540087c2c76
Tags:
ransomware autorun extens sage
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/136bd1fd0aca0ee18b15eec0f7e1076534ecfcadc1f94bad5e8716f1b2b565bd
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-28T15:11:00Z UTC
Last seen:
2026-10-30T08:46:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/136bd1fd0aca0ee18b15eec0f7e1076534ecfcadc1f94bad5e8716f1b2b565bd/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1994145
Signature
Drops PE files with benign system names
Drops script or batch files to the startup folder
Joe Sandbox ML detected suspicious sample
Sigma detected: Drops script at startup location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Potentially Suspicious Malware Callback Communication
Sigma detected: Suspect Svchost Activity
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1994145 Sample: rbxfix.exe Startdate: 28/10/2026 Architecture: WINDOWS Score: 84 77 Sigma detected: Drops script at startup location 2->77 79 Sigma detected: Potentially Suspicious Malware Callback Communication 2->79 81 Sigma detected: System File Execution Location Anomaly 2->81 83 3 other signatures 2->83 11 rbxfix.exe 200 2->11         started        15 cmd.exe 2->15         started        process3 file4 59 C:\RBXFixerTemp\_MEI00001bdc2\zlib1.dll, PE32+ 11->59 dropped 61 C:\RBXFixerTemp\_MEI00001bdc2\winsound.pyd, PE32+ 11->61 dropped 63 C:\RBXFixerTemp\...\win32pdh.pyd, PE32+ 11->63 dropped 65 109 other files (none is malicious) 11->65 dropped 87 Drops PE files with benign system names 11->87 17 rbxfix.exe 1 2 11->17         started        20 svchost.exe 15->20         started        22 conhost.exe 15->22         started        24 svchost.exe 15->24         started        26 svchost.exe 15->26         started        signatures5 process6 file7 47 C:\Users\user\AppData\Roaming\...\svchost.exe, PE32+ 17->47 dropped 28 svchost.exe 200 17->28         started        49 C:\RBXFixerTemp\_MEI00000d942\zlib1.dll, PE32+ 20->49 dropped 51 C:\RBXFixerTemp\_MEI00000d942\winsound.pyd, PE32+ 20->51 dropped 53 C:\RBXFixerTemp\...\win32pdh.pyd, PE32+ 20->53 dropped 55 109 other files (none is malicious) 20->55 dropped 32 svchost.exe 20->32         started        process8 file9 67 C:\RBXFixerTemp\_MEI00001aec2\zlib1.dll, PE32+ 28->67 dropped 69 C:\RBXFixerTemp\_MEI00001aec2\winsound.pyd, PE32+ 28->69 dropped 71 C:\RBXFixerTemp\...\win32pdh.pyd, PE32+ 28->71 dropped 73 109 other files (none is malicious) 28->73 dropped 89 Drops script or batch files to the startup folder 28->89 34 svchost.exe 2 28->34         started        37 svchost.exe 32->37         started        signatures10 process11 file12 57 C:\Users\user\AppData\...\WindowsSecurity.bat, DOS 34->57 dropped 40 svchost.exe 1 34->40         started        85 System process connects to network (likely due to code injection or exploit) 37->85 signatures13 process14 dnsIp15 75 77.239.96.159, 4444, 49719, 49721 NUXT-ASGB Germany 40->75 43 cmd.exe 40->43         started        process16 process17 45 conhost.exe 43->45         started       
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/136bd1fd0aca0ee18b15eec0f7e1076534ecfcadc1f94bad5e8716f1b2b565bd
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cnv5d7ikzihodcyv53appyihmu2oz7fnyh4uxlk6q4lpdmvvmw6q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery persistence privilege_escalation pyinstaller ransomware
Link:
https://tria.ge/reports/261028-vrjv9ssyhv/
Behaviour
Modifies registry class
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads the TCP/IP host and domain name from the registry
Sets desktop wallpaper using registry
Creates a file in the Startup directory
Executes a file named after a Windows system binary
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments