MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2cd3f398007642bba90bfa972b3587e75b6729a5b3c6efdaf8bde818c62db194. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 2cd3f398007642bba90bfa972b3587e75b6729a5b3c6efdaf8bde818c62db194 |
|---|---|
| SHA3-384 hash: | 25dd1a9c414969a789a0a12728fc55af0193c73482cc3b599d1331fe506cece6915e783582ee2eec037bdcab9dde670f |
| SHA1 hash: | 0b3b249bb8b0c35943cdc776e20f25bd3743fa20 |
| MD5 hash: | 2d8527e9ec16a153f10c4f8e32ef4866 |
| humanhash: | bulldog-pluto-virginia-lithium |
| File name: | lure_compact_fullchain.exe |
| Download: | download sample |
| File size: | 1'442'752 bytes |
| First seen: | 2026-10-23 04:10:38 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/vnd.microsoft.portable-executable |
| imphash | 555aba33e471c8bf2b9fc3922635a660 |
| ssdeep | 24576:DpVcREkJpSvpMwaCHHISvEJpHHQHLP+TWJDuBvDpp04WY1N0JC/M5YZQ8+Y2:bcNpipMwauHgPe+TqD2F+4WE0JC/MeFY |
| TLSH | T1066533F012A760C3E55C11BDBB77416ACC61B51DBBB1ABBA83A0EE3DB980551379D20C |
| TrID | 44.6% (.EXE) Win64 Executable (generic) (6522/11/2) 14.0% (.ICL) Windows Icons Library (generic) (2059/9) 13.8% (.EXE) OS/2 Executable (generic) (2029/13) 13.7% (.EXE) Generic Win/DOS Executable (2002/3) 13.6% (.EXE) DOS Executable (generic) (2000/1) |
| Magika | pebin |
| dhash icon | 30b2b2f069f0d48a (6 x AgentTesla, 3 x Vidar, 2 x PureLogsStealer) |
| Reporter |  PeterFellow |
| Tags: | beenetprotect exe fake-torrent LimeTorrents Loader |
Intelligence
File Origin
# of uploads :
1
# of downloads :
228
Origin country :
USVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Suspicious activity
Analysis date:
2026-10-23 04:13:53 UTC
Tags:
evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Clean
Score:
99.9%
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Tags:
adaptive-context installer-heuristic microsoft_visual_cc overlay packed packed
Verdict:
Malicious
Labled as:
Mikey.Generic
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-23T03:28:00Z UTC
Last seen:
2026-10-24T18:18:00Z UTC
Hits:
~100
Verdict:
Malicious
Score:
98%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Threat name:
Win64.Trojan.Khalesi
Status:
Malicious
First seen:
2026-10-23 04:11:19 UTC
File Type:
PE+ (Exe)
Extracted files:
11
AV detection:
22 of 38 (57.89%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
discovery
Behaviour
Suspicious behavior: EnumeratesProcesses
Reads the TCP/IP host and domain name from the registry
Unpacked files
SH256 hash:
2cd3f398007642bba90bfa972b3587e75b6729a5b3c6efdaf8bde818c62db194
MD5 hash:
2d8527e9ec16a153f10c4f8e32ef4866
SHA1 hash:
0b3b249bb8b0c35943cdc776e20f25bd3743fa20
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 2cd3f398007642bba90bfa972b3587e75b6729a5b3c6efdaf8bde818c62db194
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.Full-chain lure with ONLY the ~1.02 GB junk region removed: loader (= 58dffd262bb9b3c815f1017735cfa214fbbb029af8bd4cbba42c3d8db218e582) + ChaCha20 payload + 896-byte pad + 64-byte footer. The loader locates the payload relative to end-of-file, so this should run like the 1 GB original (inference; my static re-decryption of this file yields the identical stage 2 9933977b38adbe73cc852ffca785c4111b7922de7e515801ec8411e9e25708ce). Untested in a sandbox. Fake TV-episode torrent campaign (LimeTorrents; 'MobLand S02E06 A Different Corner 1080p WEB H264-CAKES.7z', also seen as Tulsa King S04E02 and VisionQuest S01E05). Outer ZIP-named-.7z sha256 ad4ab37a14f0e80e8d2d2109d3a980718ddb58583da530ec5311252a5c9514bb holds vlc-3.0.23-win64_crypted.exe (1,023,025,653 bytes, sha256 53c889d81914869958a2662518706e4f4dc47a22f380599c2967ea4b5d39288d). Same campaign as Thereallo's South Park S29E03 analysis (thereallo.dev). Footer layout from that write-up confirmed on this build: fnv1a32(.data[0:32]) = footer[0x3C] = 0xec378ff9, flags 3, payload 1,313,792 bytes, padding 896; layout [loader 128000][~1.02 GB junk][ChaCha20 payload][896 pad][64 B footer]; key = footer[0:32] XOR mask, counter 0.