MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c
SHA3-384 hash: dfd52223beddbd30f0b556ce8fed70284ad95ba34483e7310247734836c50b937960d57793b957979936c0dcbc686125
SHA1 hash: f21c1ee6d533ad46489c0fc1557f09ce5da1b1d4
MD5 hash: d0d25c1f7f7af10a45109c4f421b9127
humanhash: zulu-alanine-bulldog-potato
File name:14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c
Download: download sample
File size:3'088'393 bytes
First seen:2026-05-14 08:45:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 844c2c88505ca9c31e9e205f1843d70e
ssdeep 49152:6qS/uAofjPf4WsWpeuJ9LdrQfcXzEMc3+8E/cLbec1g3M5J0GsKvrhP:BS/orfrz60/c2cEMiKN
TLSH T19BE57DAA52A8C2E6C25BB03AC413451BDFF1BC250336D38B42597A4B3F733919DDA365
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 0cb340cdcd494624
Reporter JAMESWT_WT
Tags:104-207-135-174 155-138-247-221 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
d0d25c1f7f7af10a45109c4f421b9127
Verdict:
No threats detected
Analysis date:
2026-05-13 09:46:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c4e43f5c-6c9e-47da-959d-dc9176e903e5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/65850/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.77114198.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a058baf953bbcef1c90390f
Tags:
vmdetect nukesped
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm anti-vm crypto explorer fingerprint hacktool installer-heuristic keylogger lolbin microsoft_visual_cc nukesped overlay packed reconnaissance unsafe
Link:
https://www.filescan.io/uploads/6a058baf86e92bda702eaca4/reports/072a833c-e01d-4c98-9221-b59b8c418049/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-05-15T04:05:00Z UTC
Last seen:
2026-05-15T04:16:00Z UTC
Hits:
~10
Detections:
Trojan.Win64.Agent.smgggr
Link:
https://opentip.kaspersky.com/14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d69d704c-dfe0-4ec4-ab47-35151189a9fd
Score:
24%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/d0d25c1f7f7af10a45109c4f421b9127
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-11 18:43:31 UTC
File Type:
PE+ (Exe)
Extracted files:
64
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ctjn3iubrxtkyokudcedbpqwm7zk7pguzdsv4xiybwzsfy3w356a._file
Gathering data
Unpacked files
SH256 hash:
14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c
MD5 hash:
d0d25c1f7f7af10a45109c4f421b9127
SHA1 hash:
f21c1ee6d533ad46489c0fc1557f09ce5da1b1d4
Link:
https://www.unpac.me/results/e77d6d5e-5a18-456d-8c98-5719874c2a03/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/14d2dda2818de6ac3954188830be1667f2afbcd4c8e55e5d180db322e376df7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/65850/

Comments