MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2f21f1c2265b1072bb2f7432dc620643bef446629696d0704ae5ef88102db390. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 12
| SHA256 hash: | 2f21f1c2265b1072bb2f7432dc620643bef446629696d0704ae5ef88102db390 |
|---|---|
| SHA3-384 hash: | 602b81e17125515acc527084c2ad6194f27f7241465e85981e33e8cf7926a8953aac025ae6190d0d6caf1307b0a19209 |
| SHA1 hash: | ddf24319f2be0bb1c087f1c76078cb50da416ab8 |
| MD5 hash: | 289218847869a9fbc6b8ffa3ea8a111f |
| humanhash: | carpet-cold-solar-summer |
| File name: | 2f21f1c2265b1072bb2f7432dc620643bef446629696d0704ae5ef88102db390 |
| Download: | download sample |
| File size: | 5'819'016 bytes |
| First seen: | 2025-08-12 15:03:04 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 172750858dcc0719eed08c952858023c (117 x RedLineStealer, 3 x N-W0rm, 1 x AsyncRAT) |
| ssdeep | 98304:XcJUBcfbxiwioAcCOkbEcGduhV5BkLoSCoaMJyt0+nJzv5L+exq3Rfjcn0M:XUUeVioXC3xdCLoSCjMJW35oxK |
| Threatray | 7 similar samples on MalwareBazaar |
| TLSH | T1E74623F3933405A9D4D5CD3C9A37BEA132F65E6B8B90A87D64DE71C525332A1A223D03 |
| TrID | 28.5% (.EXE) Win64 Executable (generic) (10522/11/4) 17.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 13.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.2% (.EXE) Win32 Executable (generic) (4504/4/1) 5.6% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| dhash icon | f8dc888898a898b8 (4 x njrat, 4 x AgentTesla, 2 x AsyncRAT) |
| Reporter |  adrian__luca |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
35
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2f21f1c2265b1072bb2f7432dc620643bef446629696d0704ae5ef88102db390
Verdict:
No threats detected
Analysis date:
2025-08-12 12:28:30 UTC
Tags:
netreactor
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
92.5%
Tags:
injection obfusc virus
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Labled as:
Trojan.Generic
Verdict:
Suspicious
Score:
93%
Verdict:
Malware
File Type:
PE
Gathering data
Gathering data
Verdict:
Malicious
Threat:
VHO:Backdoor.MSIL.XWorm
Threat name:
Win32.Trojan.Kepavll
Status:
Malicious
First seen:
2025-07-31 16:00:28 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
29 of 38 (76.32%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
privateloader
Similar samples:
Result
Malware family:
n/a
Score:
5/10
Tags:
discovery
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
1f9c7b56b7a831ca7907737862fe8fcf3b11cc3278f7e09a7c2b9ebe244de2ae
MD5 hash:
1802d5ed8f349b27886a483f4df20512
SHA1 hash:
b776ad7a7438d60a44deb4c0e91f163169ce09b2
SH256 hash:
e193e86d8c883d58c24fc6b505e2c1481ef74643afd29023dec14eddf4279d73
MD5 hash:
6bd198e97737e7bf5127852424fbbf7c
SHA1 hash:
508b40bab5c1d538217cdafe2658bee28991bb5a
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
27672a129cf62c93724bce7cc434c96ca001540e41fec43874fb0721f89c1964
MD5 hash:
63c5bf35912f8ad357689f5e85d6a7f7
SHA1 hash:
bbd77aadafb8d894ae6200aba5a197cc7941d5fb
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
2f21f1c2265b1072bb2f7432dc620643bef446629696d0704ae5ef88102db390
MD5 hash:
289218847869a9fbc6b8ffa3ea8a111f
SHA1 hash:
ddf24319f2be0bb1c087f1c76078cb50da416ab8
Malware family:
RedNet
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::LoadLibraryA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.