MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff
SHA3-384 hash: 323c39feb7bee700a059f28e1dd463962044ce3045be5283800bb7308ef804a5670800a1af391f8b6876ee513feff843
SHA1 hash: 622efd2e6ff1dd652ace557a370b35376ebb025c
MD5 hash: bae00642c809512d5a349c95ea7e9d35
humanhash: washington-fourteen-foxtrot-emma
File name:Veritaseum.exe
Download: download sample
File size:616'504 bytes
First seen:2026-04-01 12:00:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:UXiZZeaRYZjGcVVwi1YzkG352ocks2suVrddFfPR03:Ujayl835zckHZrk
Threatray 15 similar samples on MalwareBazaar
TLSH T188D4EDAF6F10E2E1D9D96AFC97816D0583A0BDA375D0429E5186FB1FCE34AC38E9C144
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon f0d494c4e9e8ccf0
Reporter aachum
Tags:celebration-internet-cc dcdivas-com dropped-by-ACRStealer exe signed ZigClipper

Code Signing Certificate

Organisation:Nienow - Deckow
Issuer:Nienow - Deckow Intermediate CA 2
Algorithm:sha256WithRSAEncryption
Valid from:2025-09-30T16:27:06Z
Valid to:2028-03-31T16:27:06Z
Serial number: 014b608bee9fe558
Thumbprint Algorithm:SHA256
Thumbprint: cf3883275b5b4a46316a3a49ce2a780985331fc221030a097321698720f29427
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
iamaachum
https://dcdivas.com/wp-includes/pomo/Veritaseum.exe

C2: https://celebration-internet.cc/

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
ES ES
Vendor Threat Intelligence
Gathering data
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/60059/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69cd08ee6363ca5d27f08ba8
Tags:
injection dropper cobalt obfusc
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed signed
Link:
https://www.filescan.io/uploads/69cd08e5972c219c8d74eede/reports/21cea2d4-0317-46ed-895f-ebfba38d8cbd/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-03-31T16:27:00Z UTC
Last seen:
2026-04-02T10:12:00Z UTC
Hits:
~100
Detections:
Trojan-Spy.Win32.Stealer.sb Trojan-Dropper.Win32.Injector.sb Trojan-Dropper.Win32.Dorifel.sbd Trojan-Banker.Win32.ClipBanker.aiaa PDM:Trojan.Win32.Generic Backdoor.Win32.Androm.sb Trojan-Banker.Win32.ClipBanker.sb
Link:
https://opentip.kaspersky.com/2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4954bd87-5424-4723-8860-36a40bdba6e7
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1892040
Signature
AI detected suspicious PE digital signature
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Found stalling execution ending in API Sleep call
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Suricata IDS alerts for network traffic
Unusual module load detection (module proxying)
Behaviour
Behavior Graph:
Download SVG
Score:
69%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/bae00642c809512d5a349c95ea7e9d35
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff/
Verdict:
Malicious
Threat:
Trojan-Banker.Win32.ClipBanker
Link:
https://tip.neiki.dev/file/2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff
Threat name:
Win64.Infostealer.ClipBanker
Create hunting rule
Status:
Suspicious
First seen:
2026-04-01 01:43:41 UTC
File Type:
PE+ (Exe)
Extracted files:
18
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fvpx4izyvxs242g4qj2ycjvgb7oozu3nitiivxwt7ew7gx6xxx7q._file
Verdict:
malicious
Label(s):
unc_rust_clipper_001
Create hunting rule
Similar samples:
2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff
704e3edf8c6fddd58319de4378dad7502fff9ed71a0c41abcb69ec328b9a31ac
87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886
a82d031d99b15f8eb5a1d8cc24e55fec6d393d549edde8da9507f3cf17503ce1
b1246e4b3421acdca8b1596c6e5455f555b5b87bcff9895f2eba5164367921e8
bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8
error
f23f6d7f5778168fc9e50e3da0a16ce83b97abf95d262a5d16bea7ce12b34d99
f38f57709a23e71c14cc96a6b99dc3f55a7aeaf9c8c8332ad4d95c0c8d645a83
fafb855519e1404ba4300e7beabe44c20172042582b1658b79e589206ff5c2e6
+ 5 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/260401-n6l6lsey9z/
Behaviour
Adds Run key to start application
Executes dropped EXE
Unpacked files
SH256 hash:
2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff
MD5 hash:
bae00642c809512d5a349c95ea7e9d35
SHA1 hash:
622efd2e6ff1dd652ace557a370b35376ebb025c
Link:
https://www.unpac.me/results/8ad02661-cdbf-4f87-baac-1a83fd9c4a13/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PowerShell (PS) ps1 bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8

Executable exe 2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff

(this sample)

  
Link
https://tria.ge/260401-m4gmnsby4p/behavioral2
  
Dropped by
SHA256 bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8
  
Dropped by
ACRStealer
  
Delivery method
Distributed via web download
  
Dropped by
MD5 d9d2a405cdb5b5853e00aa33080c9ae6
Cape
Cape
https://www.capesandbox.com/analysis/60059/

Comments