MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece
SHA3-384 hash:	e2426763dd8eeb5c64eb52ca65c0b439722b371fe6a9d596673a92a86085036e35d63186364af42a57d3887d488e07e1
SHA1 hash:	2965fb319d26740f269c453cc3ef64dc787743be
MD5 hash:	7cc041f7c877c85e87d4130963842b6d
humanhash:	table-pizza-mississippi-colorado
File name:	28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece.exe
Download:	download sample
File size:	439'296 bytes
First seen:	2026-10-30 00:35:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	e109e3dc9a35d66a19913489f828b335
ssdeep	6144:QzEHYyBdKEo5L1T+fcxTPxeP7R/JfW84ff:0AYyBdKEo1t+fUxeP7RJWTf
TLSH	T18D94C1836291C0E7D0EE43B178516BD0B621BC313653BE7A07B07EE95E33B5D7A26219
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	e08cd0c96ac69ce0
Reporter	Tuxxin
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

189

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN

Malware family:

n/a

ID:

1

File name:

https://zgv2zwxzy3.saas.scythe.io/ServiceHost64

Verdict:

No threats detected

Analysis date:

2026-03-30 23:30:01 UTC

Tags:

loader

Link:

https://app.any.run/tasks/666975d0-39dc-4939-8721-d9faeb24b223

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/96019/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Variant.Lazy.673699.32594.24395.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae3e689b121dd519dceaf67

Tags:

virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug crypto microsoft_visual_cc

Link:

https://www.filescan.io/uploads/6ae3e67dd39b834bcbafa857/reports/6a747a0e-d788-4d70-ae1a-7f5fafd7b0c3/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

exe x64

First seen:

2026-10-20T17:38:00Z UTC

Last seen:

2026-10-28T14:24:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/b4322eb0-801c-435d-9bd9-230e64bb7538

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1994977

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to inject threads in other processes

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/7cc041f7c877c85e87d4130963842b6d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece/

ReversingLabs TitaniumCloud Win64.Trojan.Zenloader

Threat name:

Win64.Trojan.Zenloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-02 03:07:37 UTC

File Type:

PE+ (Exe)

Extracted files:

10

AV detection:

27 of 36 (75.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fbkq7g5h6r4rxnn6ftqx2z7nqhm6x6tncwevv3xfftbdsbn5n3ha._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/261030-ax2m2st1fz/

UnpacMe

Unpacked files

SH256 hash:

28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece

MD5 hash:

7cc041f7c877c85e87d4130963842b6d

SHA1 hash:

2965fb319d26740f269c453cc3ef64dc787743be

Link:

https://www.unpac.me/results/392093bb-c66d-41e0-88c4-424d3602535c/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 28550f9ba7f4791bb5be2ce17d67ed81d9ebfa6d15895aeee52cc23905bd6ece

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/96019/