🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2dd05eb0e233fa9fed44b626a2a85fba13405a20f28cdfe04eae45cdf426c080. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2dd05eb0e233fa9fed44b626a2a85fba13405a20f28cdfe04eae45cdf426c080
SHA3-384 hash: 05928d41c81920642dc2e419a60b887ff0693a7350c84dc5edae43f7ee35692d5e77603adc4355ed5b548b4982bf0a92
SHA1 hash: 20de36e471e686e1e79bc256d330aa3cd8283534
MD5 hash: ca391e4daae48a24f4cfa28a39bf6b93
humanhash: oregon-summer-item-wyoming
File name:wtsapi32.dll
Download: download sample
File size:22'528 bytes
First seen:2026-10-03 08:58:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 48ef58d1d33b6c67fb00792e5a8daac3
ssdeep 384:TeCDCxSqYJcb0gI+og1po3g1D9uMO0Z5vZOLzYPNuA7CIDnWiW9YW:lCxAf+oYpo3YD0Mb5xOglW9
TLSH T17FA23A8DFA8B25FCC99BD239C5B70F35B671B81001212E3F469CD6724CA09C19B35E8A
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika smica83
Reporter smica83
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-03 09:01:17 UTC
Tags:
python stealer evasion arch-exec auto-startup arch-doc openssl tool
Link:
https://app.any.run/tasks/55807e27-3015-40aa-b471-f9c404ae5b48

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/90400/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Creating a file
Moving a recently created file
Launching a process
Modifying a system file
Creating a file in the Windows subdirectories
Deleting a recently created file
Using the Windows Management Instrumentation requests
Running batch commands
Creating a process with a hidden window
Searching for the window
Changing a file
Launching a tool to kill processes
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-debug crypto exploit masquerade packed
Link:
https://www.filescan.io/uploads/6ac0c3aed14721bc7b37ad34/reports/f472724f-d965-4dfe-bce6-458e743831ef/overview
Verdict:
Malicious
Labled as:
Generik.ESBXHOW trojan
Link:
https://www.hybrid-analysis.com/sample/2dd05eb0e233fa9fed44b626a2a85fba13405a20f28cdfe04eae45cdf426c080
Verdict:
Malicious
File Type:
dll x64
First seen:
2026-10-03T00:17:00Z UTC
Last seen:
2026-10-04T18:31:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2dd05eb0e233fa9fed44b626a2a85fba13405a20f28cdfe04eae45cdf426c080/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c4dd2278-d51d-44c8-b61f-6f50c573ceea
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1981613
Signature
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Hides that the sample has been downloaded from the Internet (zone.identifier)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Powershell connects to network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Windows Binaries Write Suspicious Extensions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1981613 Sample: wtsapi32.dll.exe Startdate: 03/10/2026 Architecture: WINDOWS Score: 88 58 master.riocontadores.com 2->58 62 Malicious sample detected (through community Yara rule) 2->62 64 Multi AV Scanner detection for submitted file 2->64 66 Sigma detected: Windows Binaries Write Suspicious Extensions 2->66 68 3 other signatures 2->68 10 loaddll64.exe 2 2->10         started        signatures3 process4 process5 12 rundll32.exe 1 10->12         started        16 cmd.exe 1 10->16         started        18 rundll32.exe 10->18         started        20 33 other processes 10->20 file6 56 C:\Users\user\AppData\Local\...\x5715375.ps1, Unicode 12->56 dropped 76 Bypasses PowerShell execution policy 12->76 22 powershell.exe 14 31 12->22         started        26 rundll32.exe 1 16->26         started        28 powershell.exe 18->28         started        30 powershell.exe 20->30         started        32 powershell.exe 20->32         started        34 powershell.exe 20->34         started        36 9 other processes 20->36 signatures7 process8 file9 54 C:\Users\user\...\BackupAssistant2.msi, Composite 22->54 dropped 70 Found suspicious powershell code related to unpacking or dynamic code loading 22->70 72 Hides that the sample has been downloaded from the Internet (zone.identifier) 22->72 38 conhost.exe 22->38         started        40 powershell.exe 15 26->40         started        44 conhost.exe 28->44         started        46 conhost.exe 30->46         started        48 conhost.exe 32->48         started        50 conhost.exe 34->50         started        signatures10 process11 dnsIp12 60 master.riocontadores.com 172.67.200.214, 443, 49706, 49707 CLOUDFLARENET-CloudflareIncUS Canada 40->60 74 Powershell connects to network 40->74 52 conhost.exe 40->52         started        signatures13 process14
Score:
24%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/2dd05eb0e233fa9fed44b626a2a85fba13405a20f28cdfe04eae45cdf426c080
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/ca391e4daae48a24f4cfa28a39bf6b93
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2dd05eb0e233fa9fed44b626a2a85fba13405a20f28cdfe04eae45cdf426c080/
Threat name:
Win64.Hacktool.AMSIBypass
Create hunting rule
Status:
Suspicious
First seen:
2026-10-03 05:13:37 UTC
File Type:
PE+ (Dll)
AV detection:
8 of 24 (33.33%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fxif5mhcgp5j73kewytkfkc7xijuawra6kgn7ycovzc435bgycaa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/261003-kxcc9swt6l/
Behaviour
Checks processor information in registry
Detects videocard installed
Enumerates system info in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Checks installed software on the system
Enumerates connected drives
Creates a file in the Startup directory
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Badlisted process makes network request
Uses browser remote debugging
Unpacked files
SH256 hash:
2dd05eb0e233fa9fed44b626a2a85fba13405a20f28cdfe04eae45cdf426c080
MD5 hash:
ca391e4daae48a24f4cfa28a39bf6b93
SHA1 hash:
20de36e471e686e1e79bc256d330aa3cd8283534
Link:
https://www.unpac.me/results/bb8b6bf5-2074-4263-997f-a1dc6989e830/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2dd05eb0e233fa9fed44b626a2a85fba13405a20f28cdfe04eae45cdf426c080

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/90400/

Comments