🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879
SHA3-384 hash: 5f1d8462088e92b476dfde0bd3ced9b0e16403da914d24c0de979f4d59ac65a503dfe23235f2ec100e8e4580d8a94904
SHA1 hash: 78cb0edc6fab765ebb8a4f6467e09c745d52c330
MD5 hash: 04ab212dd768968b1cb025b40664d997
humanhash: sad-texas-lactose-double
File name:04ab212dd768968b1cb025b40664d997.exe
Download: download sample
File size:332'800 bytes
First seen:2026-11-10 10:20:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 929a3b5097dd08c234b7d5d8e867aa97
ssdeep 6144:I5y5K3rwaovrjVo35FKbCmtpRCv2PlJQ:ay5eEaovNo35gbFtrC6
TLSH T1D4645C117AA117E5C0A1A8FCA1616100DAF7B8A397D855CB0FA257B7CD3B1C1DF3BA60
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon f0e8ece696cce8f0
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
http://update-cdn.cqttech.com/update/XZHuyanbao_11004_3.0.0.27_2.exe
Verdict:
Malicious activity
Analysis date:
2026-11-10 01:29:13 UTC
Tags:
ip-check qrcode arch-scr arch-html stealer upx
Link:
https://app.any.run/tasks/91e1cbb7-7c36-4542-bc5c-013b7c455a35

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99000/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af2efe3463538821bc38df4
Tags:
virus hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating synchronization primitives
Launching the process to change network settings
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug fingerprint microsoft_visual_cc
Link:
https://www.filescan.io/uploads/6af2f017e4531b9a0942c52f/reports/38dcd7ff-8687-494f-b521-e5b5cdefc2c1/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f9c90832-94d8-4bbc-8a28-b5a1f0f6126b
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad.spre.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2003412
Signature
.NET source code contains potential unpacker
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to infect the boot sector
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs a network lookup / discovery via ARP
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses netsh to modify the Windows network and firewall settings
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2003412 Sample: rGiPmgPCsG.exe Startdate: 10/11/2026 Architecture: WINDOWS Score: 100 56 ms.jsf.ink 2->56 58 unfiltered.adguard-dns.com 2->58 60 13 other IPs or domains 2->60 80 Suricata IDS alerts for network traffic 2->80 82 Multi AV Scanner detection for submitted file 2->82 84 .NET source code contains potential unpacker 2->84 86 2 other signatures 2->86 10 rGiPmgPCsG.exe 4 2->10         started        15 dsemanager.exe 2->15         started        signatures3 process4 dnsIp5 68 ip-api.com 208.95.112.1, 49713, 49716, 49720 TUT-AS-TotalUptimeTechnologiesLLCUS United States 10->68 70 107.173.84.53, 443, 49714, 49715 AS-COLOCROSSING-HostPapaUS United States 10->70 52 C:\Users\user\AppData\...\dsemanager.exe, PE32+ 10->52 dropped 54 C:\Users\user\AppData\...\atiadlxy.dll, PE32+ 10->54 dropped 96 Contains functionality to compare user and computer (likely to detect sandboxes) 10->96 17 dsemanager.exe 10->17         started        98 Modifies the context of a thread in another process (thread injection) 15->98 100 Found direct / indirect Syscall (likely to bypass EDR) 15->100 20 netsh.exe 14 15->20         started        file6 signatures7 process8 signatures9 74 Uses netsh to modify the Windows network and firewall settings 17->74 76 Modifies the context of a thread in another process (thread injection) 17->76 78 Found direct / indirect Syscall (likely to bypass EDR) 17->78 22 netsh.exe 18 83 17->22         started        27 conhost.exe 20->27         started        process10 dnsIp11 62 ms.jsf.ink 104.21.64.13, 443, 49755 CLOUDFLARENET-CloudflareIncUS Canada 22->62 64 8.8.4.4, 443, 49743 GOOGLE-GoogleLLCUS United States 22->64 66 16 other IPs or domains 22->66 44 C:\...\WinAppDeployCommon.dll.tmp48aa8447, PE32 22->44 dropped 46 C:\Users\...\WinAppDeployCommon.dll (copy), PE32 22->46 dropped 48 Tracing.EventSourc...eck.exe.tmp2a9f605c, PE32 22->48 dropped 50 5 other files (none is malicious) 22->50 dropped 88 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 22->88 90 Contains functionality to infect the boot sector 22->90 92 Tries to harvest and steal browser information (history, passwords, etc) 22->92 94 3 other signatures 22->94 29 curl.exe 1 22->29         started        32 ARP.EXE 1 1 22->32         started        34 cmd.exe 1 22->34         started        36 2 other processes 22->36 file12 signatures13 process14 dnsIp15 72 192.168.2.1, 443, 49759, 49760 unknown unknown 29->72 38 conhost.exe 29->38         started        40 conhost.exe 32->40         started        42 conhost.exe 34->42         started        process16
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/04ab212dd768968b1cb025b40664d997
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879/
Threat name:
Win64.Trojan.Yogi
Create hunting rule
Status:
Malicious
First seen:
2026-11-06 17:52:00 UTC
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f2j4vdhcykb6nc5pydn7c3rnkdukg4gsj52kudaredeky45s3b4q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/261110-mc7psa1zhy/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Suspicious use of SetThreadContext
Looks up external IP address via web service
Network Service Discovery
Executes dropped EXE
Loads dropped DLL
Malware Family:
n/a
Verdict:
Malicious
Tags:
injector stealer rat sandbox_escape evasion
YARA:
UNPROTECT_disable_process win_token ParentProcessEvasion
Link:
https://app.threat.zone/submission/b1cc9509-14f2-4a47-9d05-59402457f82f
Malware Family:
lazy
Create hunting rule
Malicious:
True
Tags:
exe 64bit persistence wmi-activity self-delete obfuscated adapter-discovery debug-check exec-delay env-check
Link:
https://intel.virussign.com/intelligence/file/2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879
Unpacked files
SH256 hash:
2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879
MD5 hash:
04ab212dd768968b1cb025b40664d997
SHA1 hash:
78cb0edc6fab765ebb8a4f6467e09c745d52c330
Link:
https://www.unpac.me/results/d54abfc2-8527-4954-ae9f-5efa2d397d2e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2e93ca8ce2c2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Lumma_Stealer
Create hunting rule
Author:blade391off
Description:Detects Lumma Stealer malware
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/99000/

Comments