MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0
SHA3-384 hash:	91173daf926b46de04eafd63182fbf7f7f052ca7c70c3a57b3c6104604b05c3b96444d268c0fa291702806d167f3927a
SHA1 hash:	990c07fb06af6d91148c8a7a8a7938c1e30eab1c
MD5 hash:	b9e2457d5d1def16a37958b29983d307
humanhash:	pluto-golf-georgia-early
File name:	2-3716-25_07.11.2025.hta
Download:	download sample
Signature	Gamaredon Alert Create hunting rule
File size:	7'856 bytes
First seen:	2025-11-07 15:31:34 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	96:baMrvL7wx2qcLetysV0vDkukvCJYEzYO+uboOPMySIkcWjJMAJ8:c0wu6CJYBuMc+JL8
TLSH	T13EF1173AE4860E1F539A85EBC3D148C6CF3B8A12A2FB75123473939F44BD94C955B079
Magika	html
Reporter	smica83
Tags:	apt gamaredon hta UKR

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

46

Origin country :

HU

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690e110c30bacec888c96f0f

Tags:

virus overt spawn

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0/results/dashboard

Payload URLs

URL

File name

http://UDOpnRc.mq

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

lolbin mshta obfuscated

Link:

https://www.filescan.io/uploads/690e1109b2332ab627daddff/reports/8a0faa13-8b2e-4944-a247-48afea7f380d/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2025-11-07T13:01:00Z UTC

Last seen:

2025-11-09T12:01:00Z UTC

Hits:

~100

Detections:

HEUR:Trojan.Script.Generic Trojan.Win32.Agent.sb Trojan.JS.SAgent.sb

Link:

https://opentip.kaspersky.com/27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0/results?tab=lookup

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

3 / 100

Link:

https://www.joesandbox.com/analysis/1810043

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Benign

Score:

24%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/b9e2457d5d1def16a37958b29983d307

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0/

Neiki Trojan.Win32.Agent

Verdict:

Malicious

Threat:

Trojan.Win32.Agent

Link:

https://tip.neiki.dev/file/27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0

ReversingLabs TitaniumCloud Text.Trojan.Gamaredon

Threat name:

Text.Trojan.Gamaredon

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-07 15:45:49 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e66zagm6ijtrtuod54quefnbp6xch4sx3c6lpkag4okoqztbldya._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery

Link:

https://tria.ge/reports/251107-sytmyasmgk/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Badlisted process makes network request

Malware Config

Dropper Extraction:

https://ssu.gov.ua@app-334825a6-4a2b-48bc-be92-e0582d656006.cleverapps.io?/ss_07.11.2025/flashlightsK8Q/pondjSQ.pdf

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/27bd90199e426719d1c3ef214215a17fae23f257d8bcb7a806e394e8666158f0