MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
SHA3-384 hash: 90ffb1a89a8dd32b2bb98012f3c54ee41a549e5743aef524976c866004af35a80f959b167d4b7d3d5d27b993e7fb8b98
SHA1 hash: dd839cd4619e104298bb2d823f4678504f148622
MD5 hash: 3e88f1a1f48cb2a3556fdac9de4e8ef9
humanhash: oklahoma-angel-pip-apart
File name:SecuriteInfo.com.Trojan.Siggen33.3805.8792.11855
Download: download sample
File size:55'296 bytes
First seen:2026-08-04 09:41:19 UTC
Last seen:2026-08-04 10:40:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 1536:vtW4y8UFRx6GbgCSUMH18htq5Hk9Uepxc6kRdps:1W4yKBHmhg5HSUep3
TLSH T15F43092916F64B65E8728279EAB44327D0F87C46BC70421F0773CE592F938C1A67CB91
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
165
Origin country :
FR FR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/078bbd5d-149f-40fe-bf41-cd0ae3b226fc/
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
hgf.zip
Verdict:
Malicious activity
Analysis date:
2026-07-30 00:48:34 UTC
Tags:
auto generic metasploit framework processhacker tool kprocesshacker-sys vuln-driver inno installer delphi systeminformer evasion opendir phorpiex botnet github nemucod loader phishing massbass ipfs python solaris screenconnect remote possible-phishing powershell maskgramstealer asyncrat rat action1rmm rustystealer stealer clickfix rmm-tool tinynuke quasar purehvnc telegram maskgram cobaltstrike ip-check havoc guloader remusstealer smoke glamour stealc datto purelogs xworm vidar remcos pastebin payload coinminer miner autoit lumma advancedinstaller networm amus wannacry ransomware salatstealer grandoreiro banker websocket gh0st action1 meterpreter acr njrat bladabindi ghostsocks proxyware koiloader redline donutloader bruteratel hijackloader putty ammy amadey pushware adware purerat santastealer iqvw64-sys arch-exec qrcode pyinstaller
Link:
https://app.any.run/tasks/bd35397c-6be0-4a5e-ad5a-8df97f169e63

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/78764/
Detection(s):
SecuriteInfo.com.Trojan.Siggen33.3805.8792.11855.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Searching for synchronization primitives
Creating a window
Connection attempt
Sending an HTTP GET request
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Creating a process from a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Connecting to a non-recommended domain
Connection attempt to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6a71b3fb654dd1f70b376f75/reports/b29cf6c8-1c0b-4465-a563-359a096e02d2/overview
Verdict:
Malicious
Labled as:
Mint.Phil.Generic
Link:
https://www.hybrid-analysis.com/sample/1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-28T08:37:00Z UTC
Last seen:
2026-08-04T06:33:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0673feaa-679a-4696-8ea9-e46f4c6b2e86
Score:
78%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/3e88f1a1f48cb2a3556fdac9de4e8ef9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1/
Threat name:
Win64.Trojan.MintPhil
Create hunting rule
Status:
Malicious
First seen:
2026-07-28 20:39:55 UTC
File Type:
PE+ (Exe)
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7jg5kch2lb74qytelscyvh3cabe6bxgdtsvviklcywzlo232liq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/260804-lnx42sck7y/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes dropped EXE
Unpacked files
SH256 hash:
1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1
MD5 hash:
3e88f1a1f48cb2a3556fdac9de4e8ef9
SHA1 hash:
dd839cd4619e104298bb2d823f4678504f148622
Link:
https://www.unpac.me/results/1a865ec9-383c-4fec-addf-9c18cf07c76c/
Malware family:
SolarisLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1fd26ea847d2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:Detects Reflective DLL injection artifacts
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 1fd26ea847d2c3fe431322e42c54fb10024f06e61ce55aa14b162d95bb5bd2d1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3896696/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/78764/

Comments