🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c7d28fa5a5563968536784beb4f0addae0f53a4cdca5c58eac8267abbd81dcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c7d28fa5a5563968536784beb4f0addae0f53a4cdca5c58eac8267abbd81dcc
SHA3-384 hash: e05d3ae7c5aba32d6632efeaf1902c9f264aa8296826fd9c191bbcd734af5369569a6850f08ac493e87fe5236c750a59
SHA1 hash: 7ed2718c0c61ef01818ef6f4e4cd492d0b4f0bf0
MD5 hash: 96c49500448701932eb39c8300514801
humanhash: lima-whiskey-golf-social
File name:file
Download: download sample
File size:3'594'752 bytes
First seen:2026-09-04 22:22:51 UTC
Last seen:2026-09-05 01:20:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 79349caf0e8f6a76e2a57505fe2eaf2c
ssdeep 49152:MPUpQfHubAx898zDyySZO9pj4unHfvyiWi8PF:5GWr91ySZQjrHfvyikPF
TLSH T14FF5F16100C080EDF19BD6308394FA3B616937599B9CEFDB52E8BF285724C586C7AE47
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon d4923d8c8c4d8ad4
Reporter Bitsight
Tags:b dropped-by-gcleaner exe MIX2.file


Avatar
Bitsight
url: http://91.92.242.236/service

Intelligence

File Origin
# of uploads :
2
# of downloads :
180
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-09-04 23:54:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/42f8e87b-e020-46c4-b925-b89d9c79dd9a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/84106/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug fingerprint microsoft_visual_cc
Link:
https://www.filescan.io/uploads/6a9b44d1a1b8846d9f3339de/reports/83cd4a14-5c22-4b1e-9432-e97d6992e792/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/2c7d28fa5a5563968536784beb4f0addae0f53a4cdca5c58eac8267abbd81dcc
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/7808bf60-6d1c-4b2d-a16f-8b5c8fdd0158
Score:
67%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/2c7d28fa5a5563968536784beb4f0addae0f53a4cdca5c58eac8267abbd81dcc
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/96c49500448701932eb39c8300514801
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c7d28fa5a5563968536784beb4f0addae0f53a4cdca5c58eac8267abbd81dcc/
Threat name:
Win64.Trojan.AgentTesla
Create hunting rule
Status:
Suspicious
First seen:
2026-09-04 22:23:29 UTC
File Type:
PE+ (Exe)
Extracted files:
29
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fr6sr6s2kvrznbjwpbf6wtyk3wxa6u5ezxffywhkzathvo6ydxga._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260904-2awl3aaq21/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
2c7d28fa5a5563968536784beb4f0addae0f53a4cdca5c58eac8267abbd81dcc
MD5 hash:
96c49500448701932eb39c8300514801
SHA1 hash:
7ed2718c0c61ef01818ef6f4e4cd492d0b4f0bf0
Link:
https://www.unpac.me/results/acf7ab9d-68e1-4d9a-9bff-606b6786a140/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 2c7d28fa5a5563968536784beb4f0addae0f53a4cdca5c58eac8267abbd81dcc

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/84106/

Comments