MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Fuery


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7
SHA3-384 hash: f44953cdb97b15366130b56b227939c37dd1d93aec10211ff847721a093034880118c063e65f86369bd99696a1df8068
SHA1 hash: 737dc9393e89992059d0b6dca0f9fcf974145466
MD5 hash: 9008184aa4d525168dcb65a938645bb5
humanhash: wisconsin-orange-violet-stream
File name:file
Download: download sample
Signature Fuery
Create hunting rule
File size:956'416 bytes
First seen:2026-02-06 10:08:59 UTC
Last seen:2026-02-06 10:30:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'692 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 12288:6WzSKev3aGuMRFp0/1ep/G3snDfdLpISdQpCMj1iDt7He0iOIpYIqwEcGFasxR9X:61/F01e6irdVhOni9+0iOIaIW9A/3
TLSH T1EA15120E7B59B951CA0C4EB38403508C81F5DA6BF063F66E49DA4DF72CA3E58E84B593
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543 Fuery


Avatar
Bitsight
url: http://130.12.180.43/files/8360091208/VD4ZhoY.exe

Intelligence

File Origin
# of uploads :
13
# of downloads :
128
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
DeepSea
DeepSea decrypted strings
Link:
https://research.acce.ciphertechsolutions.com/results/d759420f-8f59-4605-b0e9-34f1c2e41c6d/
Malware family:
n/a
ID:
1
File name:
_24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7.exe
Verdict:
Malicious activity
Analysis date:
2026-02-06 10:09:59 UTC
Tags:
auto-reg fuery loader
Link:
https://app.any.run/tasks/a88cbbcd-4195-44cd-b353-c3f586b9cc06

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/52478/
Detection(s):
SecuriteInfo.com.Variant.Genie.8DN.1963.22312.11455.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6985bdce117f8ed8010a366a
Tags:
phishing delphi spam
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated obfuscated packed
Link:
https://www.filescan.io/uploads/6985bdcb930564ff3c8effac/reports/d2242008-9d80-4f0a-ba1c-6e20b1a0b01e/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7
Result
Gathering data
Verdict:
Unknown
File Type:
Link:
https://opentip.kaspersky.com/24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/daad297d-8163-4d07-8408-de4822169efb
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad.spre.troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1864620
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Send many emails (e-Mail Spam)
Unusual module load detection (module proxying)
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1864620 Sample: PYqcn3aO3m.exe Startdate: 06/02/2026 Architecture: WINDOWS Score: 88 33 beexsms.xyz 2->33 35 zsuzsilea.net 2->35 37 349 other IPs or domains 2->37 45 Antivirus detection for URL or domain 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected AntiVM3 2->49 53 4 other signatures 2->53 7 PYqcn3aO3m.exe 3 2->7         started        11 PYqcn3aO3m.exe 2 2->11         started        13 PYqcn3aO3m.exe 2 2->13         started        signatures3 51 Performs DNS queries to domains with low reputation 33->51 process4 file5 31 C:\Users\user\AppData\...\PYqcn3aO3m.exe.log, ASCII 7->31 dropped 55 Unusual module load detection (module proxying) 7->55 15 PYqcn3aO3m.exe 1 2 7->15         started        19 PYqcn3aO3m.exe 11->19         started        21 PYqcn3aO3m.exe 11->21         started        23 PYqcn3aO3m.exe 11->23         started        25 PYqcn3aO3m.exe 13->25         started        signatures6 process7 dnsIp8 39 beexsms.xyz 131.153.165.33 SS-ASHUS United States 15->39 41 212.237.249.51 ZITCOMDK Denmark 15->41 43 107 other IPs or domains 15->43 27 C:\Users\user\Desktop\ssleay32.dll, PE32 15->27 dropped 29 C:\Users\user\Desktop\libeay32.dll, PE32 15->29 dropped file9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7/
Verdict:
Malicious
Threat:
Family.DEEPSEAOBFUSCATOR
Link:
https://tip.neiki.dev/file/24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=es3izrlmusnhd7s3iooqy5s27yavkjdsyn4tkysrtgciapundw3q._file
Verdict:
malicious
Label(s):
cryptinfinite
Create hunting rule
Similar samples:
error
Fuery
Result
Malware family:
fuery
Create hunting rule
Score:
  10/10
Tags:
family:fuery discovery persistence trojan
Link:
https://tria.ge/reports/260206-l6xagag12e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Adds Run key to start application
Downloads MZ/PE file
Fuery
Fuery family
Malware Config
C2 Extraction:
http://let.mebeyourfriend.digital/
http://if.youwannabemylover.life/
http://make.mydaymakemyday.info/
http://iahfi.visbxskagt.com/
http://laf.oahgsfwklg.top/
http://smachrie1.weinerbuyout.top/
http://sackless2.backspacersasine.sbs/
http://recondole3.compositesclosetful.xyz/
http://dietaries4.permeatedicelanders.today/
http://epanadiplosis5.misdateswampanoag.cyou/
http://invoke6.escrimesesquipedal.digital/
http://bordrage7.kafkaesquebozo.info/
http://stacher8.disequilibrationaproctous.top/
http://scoliidae9.
Unpacked files
SH256 hash:
24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7
MD5 hash:
9008184aa4d525168dcb65a938645bb5
SHA1 hash:
737dc9393e89992059d0b6dca0f9fcf974145466
Link:
https://www.unpac.me/results/85dc9af3-80cb-4fc1-a48d-05716b9b9fd8/
SH256 hash:
9a0b46f199c21458c734784cc1ad15642db3998cfc4927606fe8065bb30e2935
MD5 hash:
011f3d655ae81dada825a9ded910e74a
SHA1 hash:
24e0dc1d1a680a14ed4501666bc242bc3c0d7df5
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/85dc9af3-80cb-4fc1-a48d-05716b9b9fd8/
SH256 hash:
724245ae3fd7d1632d6e059ad6b79ef92dec9148c6727f9779e8b23800f06260
MD5 hash:
8fb5863356fd4d1d74697aec919b07f4
SHA1 hash:
967caffb512da12ab9dc106004e2ad6b6809538b
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/85dc9af3-80cb-4fc1-a48d-05716b9b9fd8/
Parent samples :
bde515aa510b4c30129ab004d7edaab51539f3170289be077bc2649168ccafa4
24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7
SH256 hash:
49440442bb8d826446a399ec1ea9abd46fd6872d593e5b41039af53adade857d
MD5 hash:
3263f3be6bb0f34462edbd0922f6d07d
SHA1 hash:
db3c04b0dff26b283f543f62152592867b68a7bc
Link:
https://www.unpac.me/results/85dc9af3-80cb-4fc1-a48d-05716b9b9fd8/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Fuery

Executable exe 24b68cc56ca49a71fe5b439d0c765afe01552472c3793562519984803e8d1db7

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3772979/
Cape
Cape
https://www.capesandbox.com/analysis/52478/

Comments