MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c4b6b9c2fadda863748af855dc6f34bc43f716cc9368d8ed8b32f6f8eecc007. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1c4b6b9c2fadda863748af855dc6f34bc43f716cc9368d8ed8b32f6f8eecc007
SHA3-384 hash:	271aefb78af4c4e1a8711b05fa26f8e9ce86e3d8112780102c6f0eb9ea72a627123b1abe0798f96afa168b556f8b5531
SHA1 hash:	03c502efdbd0892667638252b27bcd1f080d5af6
MD5 hash:	c30bec888d243536f66af29438cfdd22
humanhash:	low-lamp-bravo-missouri
File name:	aui.8756241008.exe
Download:	download sample
Signature	ValleyRAT Alert Create hunting rule
File size:	79'463'636 bytes
First seen:	2025-10-01 06:53:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c329cfdce996b315359260e710fbdc76 (3 x SliverFox, 3 x ValleyRAT)
ssdeep	393216:RKmZuJXsmJ7coYzTiWwoVDVmfC3U8CNluI3Vaqv8Wqud76tGboYrChZZROu8WLAP:nwOD82k3L1qBw
TLSH	T110087B42A3E0D565E17B9230C5B642F6A7F37C48EB30C61F1298BD693FB37506928726
TrID	25.7% (.EXE) InstallShield setup (43053/19/16) 24.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 18.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 9.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 6.2% (.EXE) Win64 Executable (generic) (10522/11/4)
Magika	pebin
Reporter	zhuzhu0009
Tags:	backdoor exe SilverFox ValleyRAT winos

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

168

Origin country :

RU

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

aui.8756241008.exe

Verdict:

Malicious activity

Analysis date:

2025-10-01 06:56:10 UTC

Tags:

auto-sch

Link:

https://app.any.run/tasks/7ab650c4-2b66-48c0-bd23-f60b85cb30c3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68dcd03d7d643f33eab8fedc

Tags:

shellcode cobalt small micro

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending a custom TCP request

Creating a process with a hidden window

DNS request

Connection attempt

Sending an HTTP GET request

Adding an exclusion to Microsoft Defender

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-debug anti-vm base64 CAB evasive explorer installer lolbin microsoft_visual_cc overlay overlay packed

Link:

https://www.filescan.io/uploads/68dcd02d74e5a289899bb8db/reports/1daf84f8-2b7f-4129-9be2-7e2a49ef6409/overview

Hybrid Analysis HVM:Trojan/Injector.dn

Verdict:

Malicious

Labled as:

HVM:Trojan/Injector.dn

Link:

https://www.hybrid-analysis.com/sample/1c4b6b9c2fadda863748af855dc6f34bc43f716cc9368d8ed8b32f6f8eecc007

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-10-01T04:22:00Z UTC

Last seen:

2025-10-02T02:29:00Z UTC

Hits:

~100

Detections:

Trojan.Win64.Zenpak.sb Trojan.Win64.Kryplod.sb Trojan.Win32.EtwTamper.mx Trojan.Win32.Agent.sba HackTool.Multi.AmsiETWPatch.sb BSS:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/1c4b6b9c2fadda863748af855dc6f34bc43f716cc9368d8ed8b32f6f8eecc007/results?tab=lookup

Nucleon Malprob Benign

Score:

10%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/1c4b6b9c2fadda863748af855dc6f34bc43f716cc9368d8ed8b32f6f8eecc007

CERT.PL MWDB

Gathering data

Neiki Family.GH0STRAT

Verdict:

Malicious

Threat:

Family.GH0STRAT

Link:

https://tip.neiki.dev/file/1c4b6b9c2fadda863748af855dc6f34bc43f716cc9368d8ed8b32f6f8eecc007

ReversingLabs TitaniumCloud Win64.Trojan.Astraea

Threat name:

Win64.Trojan.Astraea

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-01 06:57:35 UTC

File Type:

PE+ (Exe)

Extracted files:

1131

AV detection:

14 of 38 (36.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=drfwxhbpvxnimn2iv6cv3rxtjpcd64lmze3i3dwywmxw7dxmyadq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://tria.ge/reports/251001-hpjq9szxc1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

exploit TA_Abused_Service

YARA:

suspicious_RTF_usingURLMoniker

Link:

https://app.threat.zone/submission/27fd8e46-4660-46c5-a88c-9cdbba9122b4

VMRay CobaltStrike

Malware family:

CobaltStrike

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1c4b6b9c2fad/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.