MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Intelligence 12 IOCs YARA 29 File information Comments

SHA256 hash:	1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2
SHA3-384 hash:	baa78bc859e947bc93bef6330c401eb4c5e15419361e28eebf7be44e1a42d6bcf34328808d6adf6378214cf68ee04745
SHA1 hash:	3253418c617de14ea99bfeab571de684e5cff084
MD5 hash:	3e9617df32c2abb8331f0ecfce7721c6
humanhash:	edward-thirteen-oregon-washington
File name:	1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin
Download:	download sample
File size:	9'456'640 bytes
First seen:	2026-11-10 12:14:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'354 x AgentTesla, 20'854 x Formbook, 12'417 x SnakeKeylogger)
ssdeep	196608:EZwy+lpgtI0FIQ7uMtG4T47mM/zuIdw0dbdbb:EOlv0B7BtDkiMCabd
TLSH	T13B961215E778F414ECBA03B929B24B0B47B7AC1256ADCB2AEF5138F94F42F440E15297
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	298eaaaa96b2b2e8
Reporter	kernelv0id
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

151

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Hectobmp

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7e2aea4f-3c35-4a4e-baf3-1807138a6834/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-11-10 18:05:11 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/434c697b-339c-4890-8080-9b37ebf571f9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99174/

Detection(s):

Win.Packed.Bulz-10008187-0

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af30ae2463538821bc3a0c0

Tags:

vmdetect

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm anti-vm base64 bitmap byteguard evasive explorer fingerprint lolbin masquerade obfuscated packed packed packer reconnaissance stego

Link:

https://www.filescan.io/uploads/6af30ad9a43553dc602d919a/reports/3cf1b0e5-79d0-44ad-bb98-1b6d9da51ef2/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-06-23T04:21:00Z UTC

Last seen:

2026-08-14T19:16:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8c43bcf6-7d27-4716-899a-4308ca115fbe

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/2003159

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Behaviour

Behavior Graph:

Download SVG

Verdict:

inconclusive

YARA:

7 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.24 Win 32 Exe x86

Link:

https://app.malva.re/file/3e9617df32c2abb8331f0ecfce7721c6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2/

Threat name:

Win32.Dropper.AdvML

Status:

Malicious

First seen:

2026-06-23 06:28:13 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 36 (58.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dmex7n5znd5mwalvtdpqgp75frdx7bhxcorqgx5n4jth33qu7wra._file

Result

Malware family:

n/a

Score:

6/10

Tags:

crypter discovery hacktool packer

Link:

https://tria.ge/reports/261110-pe4f9as1av/

Behaviour

Program crash

System Location Discovery: System Language Discovery

Packer/crypter tool: SecureByte

Malware Family:

n/a

Verdict:

Suspicious

Tags:

n/a

YARA:

INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL ConventionEngine_Anomaly_MultiPDB_Double ConventionEngine_Term_Desktop ConventionEngine_Term_Users WMI_strings Check_Qemu_Description vmdetect Check_VBox_VideoDrivers DelayBatch WMI_VM_Detect

Link:

https://app.threat.zone/submission/8eaa09c9-5485-4cc5-afa0-23cd99d5631d

Malware Family:

genericfca

Malicious:

True

Tags:

dotnet debug-check exe

Link:

https://intel.virussign.com/intelligence/file/1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2

Unpacked files

SH256 hash:

1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2

MD5 hash:

3e9617df32c2abb8331f0ecfce7721c6

SHA1 hash:

3253418c617de14ea99bfeab571de684e5cff084

Link:

https://www.unpac.me/results/35868765-482b-40ea-a819-0e43a1a55c01/

SH256 hash:

47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

MD5 hash:

2f1a50031dcf5c87d92e8b2491fdcea6

SHA1 hash:

71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

Link:

https://www.unpac.me/results/35868765-482b-40ea-a819-0e43a1a55c01/

SH256 hash:

bd9cdcfaa0edecdb89a204965d20f4a896c6650d4840e28736d9bd832390e1c5

MD5 hash:

0b0e63957367e620b8697c5341af35b9

SHA1 hash:

69361c2762b2d1cada80667cd55bc5082e60af86

Link:

https://www.unpac.me/results/35868765-482b-40ea-a819-0e43a1a55c01/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Qemu_Description Create hunting rule

Rule name:	Check_Qemu_DeviceMap Create hunting rule

Rule name:	Check_VBox_Description Create hunting rule

Rule name:	Check_VBox_DeviceMap Create hunting rule

Rule name:	Check_VBox_Guest_Additions Create hunting rule

Rule name:	Check_VBox_VideoDrivers Create hunting rule

Rule name:	Check_VmTools Create hunting rule

Rule name:	Check_VMWare_DeviceMap Create hunting rule

Rule name:	cobalt_strike_beacon_detected Create hunting rule
Author:	0x0d4y
Description:	This rule detects cobalt strike beacons.

Rule name:	data_manipulation Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects data manipulation routines including XOR encoding, Base64 references, and RC4 PRGA encryption

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TigerRAT_pe_yaraify Create hunting rule
Author:	hunts-yara-code
Description:	YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits

Rule name:	WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Derialock (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_43faefd2 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_f1079127 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/99174/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample