MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35355ac21f1baed0dac02a947f37c972859afaa02045c385683dbd74f991c1bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 4 File information Comments

SHA256 hash:	35355ac21f1baed0dac02a947f37c972859afaa02045c385683dbd74f991c1bc
SHA3-384 hash:	25a11ab207d739d906eb3eed22c49781cbb34588aa543080fb1c26ff210bf1af2dc535b639074ba41ccb14d7626c6216
SHA1 hash:	1af49d7d694c37c4f21bd4217f54f6c5b6d15dab
MD5 hash:	204c6e62cf75eb1b2b9e47cd53d513fb
humanhash:	twelve-grey-iowa-michigan
File name:	SecuriteInfo.com.Win32.Agent-BERT.32276527
Download:	download sample
File size:	5'755'016 bytes
First seen:	2026-02-23 17:27:13 UTC
Last seen:	2026-02-23 18:27:14 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	6c871eb5afcc648e749d578ab8277277 (4 x GOBackdoor)
ssdeep	98304:RZSnriWO0EyyluOkK2EsE1xbh3aeKz4gKLMYXrdzH0xCdocoGL4UmxoUQkq:nSTOVl/TY8nK74gKLHQ/wtzUHq
TLSH	T1074623B5F5C344B4C88E99344602FA7EBA372DAA4B50CFD7B58E2A85DDB33DA6031501
TrID	34.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 13.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 13.7% (.EXE) Win64 Executable (generic) (6522/11/2) 10.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	dll

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/54324/

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699c8df8c950ab5d9ab0f004

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug invalid-signature mingw packed signed

Link:

https://www.filescan.io/uploads/699c8df49eaae846593e1044/reports/5e4da9cc-8b3b-44a7-857a-9c626068d904/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/35355ac21f1baed0dac02a947f37c972859afaa02045c385683dbd74f991c1bc

Result

Gathering data

Verdict:

Malicious

File Type:

dll x32

Link:

https://opentip.kaspersky.com/35355ac21f1baed0dac02a947f37c972859afaa02045c385683dbd74f991c1bc/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/a6f1b2b8-56bc-405c-8a22-01e8ddaf551e

Score:

74%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/35355ac21f1baed0dac02a947f37c972859afaa02045c385683dbd74f991c1bc

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/35355ac21f1baed0dac02a947f37c972859afaa02045c385683dbd74f991c1bc/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gu2vvqq7doxnbwwafkkh6n6jokczv6vaebc4hblihw6xj6mryg6a._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/260223-v1ja4act4a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Unpacked files

SH256 hash:

35355ac21f1baed0dac02a947f37c972859afaa02045c385683dbd74f991c1bc

MD5 hash:

204c6e62cf75eb1b2b9e47cd53d513fb

SHA1 hash:

1af49d7d694c37c4f21bd4217f54f6c5b6d15dab

Link:

https://www.unpac.me/results/9ce8bc24-7f09-477f-8342-d867cbdf4e6f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/35355ac21f1baed0dac02a947f37c972859afaa02045c385683dbd74f991c1bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.