MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2064487aade7f198a1f42ae3b3aba8003e7593077accf5f42177ef45b16a0607. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 13

Intelligence 13 IOCs YARA 9 File information Comments

SHA256 hash:	2064487aade7f198a1f42ae3b3aba8003e7593077accf5f42177ef45b16a0607
SHA3-384 hash:	ca664485cfebbc1952a36af1c2a6924250c5036a11b01c940011e1acf31eacc9bc33f75853f642dad45bc3222cdb182c
SHA1 hash:	76d887e83c79c42f25f5bf2608eb01bc45e1c696
MD5 hash:	3a119820edb9096dd43b5fd7ccc48bc5
humanhash:	golf-connecticut-item-chicken
File name:	eba4591f2de2c5aa51cbc15e12aed2635722c5d49ee50a3d8ef625a571ef63db
Download:	download sample
File size:	829'952 bytes
First seen:	2026-06-30 07:38:55 UTC
Last seen:	2026-06-30 08:45:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e6dca20011a213715b98fb416c7680c8 (1 x ChromElevator)
ssdeep	24576:DM+/6lqYLrI1k0QAc/mUMtW9wW6I5ubBbmwLXrj:QYiqirIZ6mU8MI
TLSH	T10605B051FFC258F3E6C60578A1EA6B375F3C96054322DED3E38419A5A8201D26A3E3DD
TrID	38.2% (.EXE) Win64 Executable (generic) (6522/11/2) 26.4% (.EXE) Win32 Executable (generic) (4504/4/1) 11.8% (.EXE) OS/2 Executable (generic) (2029/13) 11.7% (.EXE) Generic Win/DOS Executable (2002/3) 11.7% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 eba4591f2de2c5aa51cbc15e12aed2635722c5d49ee50a3d8ef625a571ef63db

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	385'536 bytes
File size (de-compressed) :	829'952 bytes
Format:	win32/pe
Packed file:	eba4591f2de2c5aa51cbc15e12aed2635722c5d49ee50a3d8ef625a571ef63db

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-06-30 07:43:38 UTC

Tags:

ip-check evasion

Link:

https://app.any.run/tasks/eafab9a0-045f-4253-93b9-8d545e228344

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72454/

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a4373301548daf709fb3617

Tags:

phishing emotet spam

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Connection attempt

Sending a custom TCP request

DNS request

Sending an HTTP GET request

Running batch commands

Creating a process with a hidden window

Creating a file in the %temp% directory

Deleting a recently created file

Creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug base64 crypto expand hacktool lolbin microsoft_visual_cc reconnaissance stealer

Link:

https://www.filescan.io/uploads/6a4372b6cebed922b90843c3/reports/8705115e-ccc6-48ff-929c-ccd0a62231d0/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/2064487aade7f198a1f42ae3b3aba8003e7593077accf5f42177ef45b16a0607

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-06-17T18:05:00Z UTC

Last seen:

2026-06-22T16:20:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/2064487aade7f198a1f42ae3b3aba8003e7593077accf5f42177ef45b16a0607/results?tab=lookup

Gathering data

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1935420

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

58%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/2064487aade7f198a1f42ae3b3aba8003e7593077accf5f42177ef45b16a0607

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2064487aade7f198a1f42ae3b3aba8003e7593077accf5f42177ef45b16a0607/

Verdict:

Malicious

Threat:

Trojan-PSW.Win32.Stealer

Link:

https://tip.neiki.dev/file/2064487aade7f198a1f42ae3b3aba8003e7593077accf5f42177ef45b16a0607

Threat name:

Win32.Packed.Generic

Status:

Suspicious

First seen:

2026-06-18 00:44:47 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 36 (58.33%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ebseq6vn47yzripuflr3hk5iaa7hleyhplgpl5bbo7xulmlkaydq._file

Verdict:

malicious

Label(s):

unc_loader_089

Similar samples:

error

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/260630-jhepeah14x/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

2064487aade7f198a1f42ae3b3aba8003e7593077accf5f42177ef45b16a0607

MD5 hash:

3a119820edb9096dd43b5fd7ccc48bc5

SHA1 hash:

76d887e83c79c42f25f5bf2608eb01bc45e1c696

Link:

https://www.unpac.me/results/f5478f4b-dea4-4daf-90cc-839b64faa838/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2064487aade7f198a1f42ae3b3aba8003e7593077accf5f42177ef45b16a0607

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/