MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GLOBAL


Vendor detections: 15


Intelligence 15 IOCs YARA 8 File information Comments 2
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d
SHA3-384 hash: 8f3d20256b39e48faddf95f3a6dc45dba1ed58dafb2858e5b2924b28fc89baf29743938d556f64a8d4e7549ce49ae753
SHA1 hash: cdf8f828912bda3c8c5fd4b65db68d6b7ba41c94
MD5 hash: dd4e0701849166c0519315662796ea7f
humanhash: six-floor-moon-jupiter
File name:23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d
Download: download sample
Signature GLOBAL
Create hunting rule
File size:240'128 bytes
First seen:2025-08-19 21:30:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 934cf7ece072cb192e6f1696c5852040 (34 x GLOBAL)
ssdeep 6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H:MQQBMLEi+AVT/H
Threatray 5 similar samples on MalwareBazaar
TLSH T125347D30BBD28431F5B75A721979A7764C3E38270B31D6CFA790096AED306C18B35B66
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter johnk3r
Tags:exe global

Intelligence

File Origin
# of uploads :
1
# of downloads :
46
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d.exe
Verdict:
Malicious activity
Analysis date:
2025-08-19 21:32:19 UTC
Tags:
smb mamona ransomware
Link:
https://app.any.run/tasks/288ecc25-ad97-4146-901f-359ecd172717

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/22328/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a4ed0f8fd55a79c5294c2f
Tags:
vmdetect
Result
Verdict:
Malware
Maliciousness:

Behaviour
Restart of the analyzed sample
Creating a process with a hidden window
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching a service
Creating a window
Searching for the window
Creating a file in the system32 subdirectories
Running batch commands
Creating a file
Changing a file
Modifies multiple files
Sending a custom TCP request
Connection attempt
Moving a file to the system32 subdirectory
Replacing files
Launching a process
Network activity
Reading critical registry keys
Searching for synchronization primitives
Forced shutdown of a system process
Creating a file in the mass storage device
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm base64 cmd dotnet evasive fingerprint hacktool lolbin microsoft_visual_cc mpcmdrun msbuild schtasks threat veeam
Link:
https://www.filescan.io/uploads/68a4ed0cabfbaec318261898/reports/4a69c44c-861a-4202-8def-acff44f3c36c/overview
Verdict:
Malicious
Labled as:
Ransom.Imps.Generic
Link:
https://www.hybrid-analysis.com/sample/23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d
Malware family:
GLOBAL
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4fb5fc24-7356-4ec4-9c49-ebd51442d55f
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.spre.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1760592
Signature
Contains functionality to enumerate network shares of other devices
Creates files in the recycle bin to hide itself
Deletes shadow drive data (may be related to ransomware)
Found Tor onion address
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes a notice file (html or txt) to demand a ransom
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1760592 Sample: pAPHfGH8Nv.exe Startdate: 19/08/2025 Architecture: WINDOWS Score: 88 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Found Tor onion address 2->52 54 3 other signatures 2->54 8 pAPHfGH8Nv.exe 1 2->8         started        11 onenoteim.exe 50 26 2->11         started        14 ONENOTE.EXE 141 392 2->14         started        16 FXSSVC.exe 18 6 2->16         started        process3 dnsIp4 64 Contains functionality to enumerate network shares of other devices 8->64 66 Deletes shadow drive data (may be related to ransomware) 8->66 68 Writes a notice file (html or txt) to demand a ransom 8->68 18 pAPHfGH8Nv.exe 3 74 8->18         started        23 conhost.exe 8->23         started        46 ln-0007.ln-msedge.net 150.171.22.17, 443, 49723 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->46 signatures5 process6 dnsIp7 40 192.168.2.100 unknown unknown 18->40 42 192.168.2.101 unknown unknown 18->42 44 97 other IPs or domains 18->44 32 C:\Users\user\Documents\README.VbeyB.txt, ASCII 18->32 dropped 34 C:\Users\user\Desktop\README.VbeyB.txt, ASCII 18->34 dropped 36 C:\Users\user\Contacts\README.VbeyB.txt, ASCII 18->36 dropped 38 9 other files (8 malicious) 18->38 dropped 56 Creates files in the recycle bin to hide itself 18->56 58 Found Tor onion address 18->58 60 Deletes shadow drive data (may be related to ransomware) 18->60 62 Modifies existing user documents (likely ransomware behavior) 18->62 25 cmd.exe 1 18->25         started        28 conhost.exe 18->28         started        file8 signatures9 process10 signatures11 70 Deletes shadow drive data (may be related to ransomware) 25->70 30 conhost.exe 25->30         started        process12
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d/
Verdict:
Malicious
Threat:
Trojan-Ransom.Win32.Encoder
Link:
https://tip.neiki.dev/file/23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d
Threat name:
Win32.Ransomware.Devman
Create hunting rule
Status:
Malicious
First seen:
2025-08-19 21:31:40 UTC
File Type:
PE (Exe)
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eo2dejwvhywizwkrtv4fxj23qm732emttti5ocmz7bgbgzns3joq._file
Verdict:
malicious
Label(s):
globalransomware
Create hunting rule
genericransomware
Create hunting rule
Similar samples:
13b82f4ac62faf87a105be355c82bacfcbdd383050860dfa93dfbb7bb2e6c9ba
GLOBAL
23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d
GLOBAL
c7b91de4b4b10c22f2e3bca1e2603160588fd8fd829fd46103cf536b6082e310
GLOBAL
error
GLOBAL
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery ransomware
Link:
https://tria.ge/reports/250819-1cw5yagn8z/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in System32 directory
Sets desktop wallpaper using registry
Enumerates connected drives
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/41afd854-12f4-4a4b-9e82-ff93628de30c
Unpacked files
SH256 hash:
23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d
MD5 hash:
dd4e0701849166c0519315662796ea7f
SHA1 hash:
cdf8f828912bda3c8c5fd4b65db68d6b7ba41c94
Link:
https://www.unpac.me/results/8bb13ade-d053-46a3-bc18-af1a423a0e02/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/23b43226d53e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/23b43226d53e2c8cd9519d785ba75b833fbd11939cd1d70999f84c1365b2da5d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICOUS_EXE_References_VEEAM
Create hunting rule
Author:ditekSHen
Description:Detects executables containing many references to VEEAM. Observed in ransomware
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/22328/

Comments


Avatar
commented on 2025-09-10 18:45:34 UTC

Just looked into this and the file contains reference to ONGOING ransomware negotiations. Idk if it should be remove until then or not but there multiple analysis of the file online so the cat is already out of the bag.

Avatar
commented on 2025-09-04 22:21:07 UTC

looks like a GLOBAL ransomware sample?