MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc
SHA3-384 hash: be1b9f5df0d611feed8c01e0a37722d4023f9e5c192cb388584080e96f9e173014faeff9e0a303dd14870ec9d560ee47
SHA1 hash: 5e753af9972459a61ba2e79b5a13097ad22ac87f
MD5 hash: c8584bf992c3506f47de66b865e29081
humanhash: quebec-romeo-island-arkansas
File name:可以过kehuduan.exe
Download: download sample
File size:125'952 bytes
First seen:2026-03-01 17:34:13 UTC
Last seen:2026-03-01 18:27:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9e2b52bb5ec60475db03de32800291c6
ssdeep 3072:BhwSwQEKCaLL9ED+TcIhOxW5OVAcHnjqczymAQdn+qcuZeqy:Bh24PVEDWcIhjCH2Cbpeqy
TLSH T124C38C01B5C0C471D8B625350D74DBB58A3CF9300F61AEEB67D826BA5F342C0AA35EA7
TrID 22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win64 Executable (generic) (6522/11/2)
17.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.7% (.EXE) Win32 Executable (generic) (4504/4/1)
7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Ling
Tags:CobaltStrike exe SilverFox Trojan:Win32/Malgent!MSR


Avatar
CNGaoLing
This sample has been reviewed by Microsoft researchers and determined to be malware. (Trojan:Win32/Malgent!MSR)

CobaltStrike & SilverFox
IOC (IP 111.229.157.84)

Intelligence

File Origin
# of uploads :
2
# of downloads :
137
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
可以过kehuduan.exe
Verdict:
No threats detected
Analysis date:
2026-03-01 14:18:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/32a90e3e-f559-4b2b-ac97-3695e33e95e3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/55143/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69a478a1e1f958bf668267d8
Tags:
remo
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug microsoft_visual_cc
Link:
https://www.filescan.io/uploads/69a4789797feb4afd662cc09/reports/20e14a9e-95e1-4e49-82ac-c4d816c0263d/overview
Verdict:
Malicious
Labled as:
Trojan.Heur3.LPT.Generic
Link:
https://www.hybrid-analysis.com/sample/20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc
Result
Gathering data
Verdict:
Malicious
File Type:
exe x32
Detections:
Backdoor.Win32.Xkcp.cei Backdoor.Win32.Xkcp.a
Link:
https://opentip.kaspersky.com/20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c113edf1-0af6-44ab-ac69-562090843bb7
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc/
Verdict:
Malicious
Threat:
Backdoor.Win32.Xkcp
Link:
https://tip.neiki.dev/file/20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-03-01 17:16:14 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
7 of 36 (19.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=edjfnqrut7o2lljqs4umoijhl5nz43vnrhfu23rzdnmktg5yiw6a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/260301-v5jgnahs9g/
Behaviour
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc
MD5 hash:
c8584bf992c3506f47de66b865e29081
SHA1 hash:
5e753af9972459a61ba2e79b5a13097ad22ac87f
Link:
https://www.unpac.me/results/a88931b4-95f9-4065-8f68-7ffc8ebdec4d/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Debugger
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/55143/

Comments