MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ecabf369edc09fa1fcff323a785a3ad97cb9acd5f281f23e7a0c3397cae3cc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 5 File information Comments

SHA256 hash:	1ecabf369edc09fa1fcff323a785a3ad97cb9acd5f281f23e7a0c3397cae3cc7
SHA3-384 hash:	a5cc679abf18ac90e13f11f630a8488777afa0fced8e64cc209ab5277b6fec70aef6f695fccd733720da7d102f787cc9
SHA1 hash:	9dc435805660f66b8a05220902a1a8a73e27db5c
MD5 hash:	4ed590c66ad064640797c88804155e4d
humanhash:	vermont-connecticut-equal-mountain
File name:	stage2_decrypted.bin
Download:	download sample
File size:	3'549'184 bytes
First seen:	2026-08-14 14:12:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	49152:q9Owq5h97rHIqb1byOJmFsp6EBSPi4hHjbnZKcd/TDd9Zdvhv3:q9A7DIqb1b4FspvBSPJ5jbE0
TLSH	T108F51A85AF08F542D0B8533283DA5B196225CE95B6C2FBDFBA857CBC6F5B3FA4408441
TrID	45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 18.0% (.EXE) Win64 Executable (generic) (6522/11/2) 13.9% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.ICL) Windows Icons Library (generic) (2059/9) 5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	aachum
Tags:	decrypted exe feafetoboary-lol kefaisce-cfd Stage2

iamaachum

https://start2playmusic.com/c9bhl9k.php => https://workshop.avatar4devs.com/u

IOCs:
https://kefaisce.cfd/aKVbz/get/DropoutSwifter.js
feafetoboary.lol

Intelligence

File Origin

# of uploads :

# of downloads :

184

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-08-14 14:52:53 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/a16fc286-ce16-4f97-90f5-1cc380626c76

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/81178/

Result

Verdict:

Clean

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 masquerade obfuscated

Link:

https://www.filescan.io/uploads/6a7f2289a2cb727a73a93cf3/reports/723d240a-4626-4c79-bdba-e802b2b956e0/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/1ecabf369edc09fa1fcff323a785a3ad97cb9acd5f281f23e7a0c3397cae3cc7

Verdict:

Unknown

File Type:

executable.pe.64.dll

Link:

https://opentip.kaspersky.com/1ecabf369edc09fa1fcff323a785a3ad97cb9acd5f281f23e7a0c3397cae3cc7/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/a6bc2e5d-6f36-4348-93c9-c5faeac86f76

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1958251

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/1ecabf369edc09fa1fcff323a785a3ad97cb9acd5f281f23e7a0c3397cae3cc7

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.22 Win 64 Exe x64

Link:

https://app.malva.re/file/4ed590c66ad064640797c88804155e4d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ecabf369edc09fa1fcff323a785a3ad97cb9acd5f281f23e7a0c3397cae3cc7/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-08-14 14:27:34 UTC

File Type:

PE+ (.Net Dll)

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d3fl6nu63qe7uh6p6mr2pbndvwl4xgwnl4ub6i7hudbts7fohtdq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260814-rjm16svhnf/

Unpacked files

SH256 hash:

1ecabf369edc09fa1fcff323a785a3ad97cb9acd5f281f23e7a0c3397cae3cc7

MD5 hash:

4ed590c66ad064640797c88804155e4d

SHA1 hash:

9dc435805660f66b8a05220902a1a8a73e27db5c

Link:

https://www.unpac.me/results/623389a4-9d26-4fee-9b20-28ef4ea3fa1b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.72

Link:

https://yomi.yoroi.company/submissions/1ecabf369edc09fa1fcff323a785a3ad97cb9acd5f281f23e7a0c3397cae3cc7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)