MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e546d8cee635b86e389b3d4430cefadaf7db1c9116487e480fea06badb30ea7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments 1

SHA256 hash:	2e546d8cee635b86e389b3d4430cefadaf7db1c9116487e480fea06badb30ea7
SHA3-384 hash:	cdd5b3d3ab9ea57ae06899bf510a87dd68702c6059bdedb46bd30d3f9b7bc3cdabce026e47f91093a6e00fc6ff737eb0
SHA1 hash:	815112e64805b2ea00fbb00b0ddfcd7949a980c4
MD5 hash:	3d58ee841d168868554d472e616d95a1
humanhash:	snake-ack-romeo-alanine
File name:	lure-2e546d8cee63.exe
Download:	download sample
File size:	124'928 bytes
First seen:	2026-10-23 17:14:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	555aba33e471c8bf2b9fc3922635a660
ssdeep	3072:V3sDSE3TM6MYS2k9Hc3/nl6LAHkzI1UfgEA6IIyRH:vE3TDzk96kAD
TLSH	T18EC3C02656CAD0D7E92E413CE123359BDA703C085374A9FF53F0AD6A7D81D40AB6A24F
TrID	44.6% (.EXE) Win64 Executable (generic) (6522/11/2) 14.0% (.ICL) Windows Icons Library (generic) (2059/9) 13.8% (.EXE) OS/2 Executable (generic) (2029/13) 13.7% (.EXE) Generic Win/DOS Executable (2002/3) 13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	30b2b2f069f0d48a (6 x AgentTesla, 3 x Vidar, 2 x PureLogsStealer)
Reporter	PeterFellow
Tags:	exe fake-torrent padded

Intelligence

File Origin

# of uploads :

# of downloads :

183

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-23 17:21:19 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7481d972-5d5a-4df4-96d7-47e81895abc4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/94273/

Detection(s):

SecuriteInfo.com.Variant.Mikey.195633.77112623.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6adb96315a22ac805bd9dc71

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching a service

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

adaptive-context installer-heuristic microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/6adb9629b64f2fa4ef8b99a3/reports/0b2584e4-854b-43e7-9aa6-827d2cb4ba9b/overview

Verdict:

Malicious

Labled as:

Mikey.Generic

Link:

https://www.hybrid-analysis.com/sample/2e546d8cee635b86e389b3d4430cefadaf7db1c9116487e480fea06badb30ea7

Verdict:

Unknown

File Type:

exe x64

Link:

https://opentip.kaspersky.com/2e546d8cee635b86e389b3d4430cefadaf7db1c9116487e480fea06badb30ea7/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/f91b1fb0-746c-40e4-bd08-6766cccb8adb

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2e546d8cee635b86e389b3d4430cefadaf7db1c9116487e480fea06badb30ea7

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/3d58ee841d168868554d472e616d95a1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e546d8cee635b86e389b3d4430cefadaf7db1c9116487e480fea06badb30ea7/

Threat name:

Win64.Trojan.AdvML

Status:

Malicious

First seen:

2026-10-23 17:15:29 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fzkg3dhomnnyny4jwpkegdhpvwxx3mojcfsipzea72qgxlntb2tq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261023-vsrbqsy1gs/

Unpacked files

SH256 hash:

2e546d8cee635b86e389b3d4430cefadaf7db1c9116487e480fea06badb30ea7

MD5 hash:

3d58ee841d168868554d472e616d95a1

SHA1 hash:

815112e64805b2ea00fbb00b0ddfcd7949a980c4

Link:

https://www.unpac.me/results/b25b4ab3-2f17-4633-b8b6-3826bec8712f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.03

Link:

https://yomi.yoroi.company/submissions/2e546d8cee635b86e389b3d4430cefadaf7db1c9116487e480fea06badb30ea7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FakeTorrent_Loader_HashedAPI_Win64 Create hunting rule
Author:	PeterFellow
Description:	Stage-1 x64 loader from fake TV-episode torrents (LimeTorrents etc., Oct 2026; same campaign as Thereallo's South Park S29E03 analysis, C2 beenetprotect.com). Decoy USER32/GDI32/ole32 imports with no kernel32, a \SystemRoot\System32\ native path, and repeated FNV-1a prime multiplications (the article documents FNV-1a for the footer; its role in API resolution is unverified). Per that analysis the overlay carries a ChaCha20-encrypted stealer and a 64-byte footer, behind roughly 0.9-1 GB of padding.
Reference:	https://bazaar.abuse.ch/sample/8ce1805f5b1ca8c4ecd4d1731caf37de33c52e686200331f4a0ea4e6b31ff606/

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 2e546d8cee635b86e389b3d4430cefadaf7db1c9116487e480fea06badb30ea7

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/94273/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Peter Fellow commented on 2026-10-23 17:15:36 UTC

Stage 1 loader ONLY (PE image trimmed to 124,928 B; padding, encrypted payload and footer removed). Build compiled 2026-10-22 17:38:09 UTC. Delivered via LimeTorrents as 'VisionQuest S01E05 Firewall 1080p WEB H264-FLUX 7z' and 'South Park S29E04 1080p WEB H264-CAKES 7z' (same 875 MB archive, sha256 eb9d7b0b9c474428f82a100d330d1fc01f6902ed6c90d20e707ad5769e48f751), containing 'Abbott Elementary S06E04 Halloween Party 1080p WEB H264-FLUX.exe' (912,764,314 B, sha256 f64c72efbc83a0854d3ad4138cc2b94d88ea628becf6e950f7c1854cac1358f4). Same family as 58dffd262bb9 / 8ce1805f (YARA FakeTorrent_Loader_HashedAPI_Win64). Full chain: 4933174f1140b15dc7789e0dc207830465d450c586e48ab6a931131eb2a6c1bf; decrypted stage 2: 8dde632a363c563929045e50d400ba03331b250b74ca04474259478eea389667. Footer/ChaCha20 format per https://thereallo.dev/blog/someone-on-torrent-sites-kept-fucking-with-my-sonarr-setup