MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19801bfff10fc0605820a7d7bf7a5cdbe07073188eec8308f62f228a7a0307c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	19801bfff10fc0605820a7d7bf7a5cdbe07073188eec8308f62f228a7a0307c0
SHA3-384 hash:	212e259b8accab00a5278d290f93b32fdf81307215f5896e31c267be650351f15a6edd0ea6b64571188ef09d2add2910
SHA1 hash:	2a8f43aced21de2b24d128ca308df2a5ac3d8516
MD5 hash:	e506f1cc11f133d40e9f8781304692d3
humanhash:	cat-florida-batman-south
File name:	cherry41.exe
Download:	download sample
File size:	92'171'776 bytes
First seen:	2025-12-03 17:44:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9bf3f5698d1c8e5d8bbe8d194ac5d544
ssdeep	786432:npNzhI+nsVt6mHaIvAN6v+s4pgPVlcmg:nDNI+nsPcN6v+A
TLSH	T1FC187D13B3A704D5E8F7DA7496E65223A932BC062F3085DF324C47261F73AE05A76B61
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	cherry41 exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

643

Origin country :

IT

Vendor Threat Intelligence

ACCE MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/519fc68b-81ce-4ee8-a146-a967752c25cb/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

cherry41.exe

Verdict:

Malicious activity

Analysis date:

2025-12-03 17:45:28 UTC

Tags:

evasion stealer python arch-doc miner winring0-sys vuln-driver themida xor-url generic upx

Link:

https://app.any.run/tasks/febc39b3-d6ed-4ba8-ac14-3f5b34cab137

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69307722264b106bd646909b

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a process with a hidden window

Launching a process

Creating a file

Creating a file in the %temp% directory

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a process from a recently created file

Moving a recently created file

Searching for analyzing tools

Searching for the window

Creating a window

Restart of the analyzed sample

Connection attempt to an infection source

Unauthorized injection to a recently created process

Sending an HTTP GET request to an infection source

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug crypto fingerprint microsoft_visual_cc

Link:

https://www.filescan.io/uploads/69307703189af9fec66b95d7/reports/b8d6bb2c-7389-4775-a027-dd590d78b7d7/overview

Hybrid Analysis Trojan.Heur

Verdict:

Suspicious

Labled as:

Trojan.Heur

Link:

https://www.hybrid-analysis.com/sample/19801bfff10fc0605820a7d7bf7a5cdbe07073188eec8308f62f228a7a0307c0

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-12-04T00:22:00Z UTC

Last seen:

2025-12-04T00:49:00Z UTC

Hits:

~1000

Detections:

UDS:DangerousObject.Multi.Generic

Link:

https://opentip.kaspersky.com/19801bfff10fc0605820a7d7bf7a5cdbe07073188eec8308f62f228a7a0307c0/results?tab=lookup

Nucleon Malprob Malware

Score:

81%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/19801bfff10fc0605820a7d7bf7a5cdbe07073188eec8308f62f228a7a0307c0

CERT.PL MWDB

Gathering data

Neiki NetworkReferences.Malware.Generic

Verdict:

Malicious

Threat:

NetworkReferences.Malware.Generic

Link:

https://tip.neiki.dev/file/19801bfff10fc0605820a7d7bf7a5cdbe07073188eec8308f62f228a7a0307c0

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-12-03 02:56:43 UTC

File Type:

PE+ (Exe)

Extracted files:

11

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dgabx77rb7agawbau7l366s43pqha4yyr3wigchwf4riu6qda7aa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/251203-wbfz4sep2v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2e252d96-1ce9-48dc-bb66-c48bb53715a0

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.