🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3745e309e31adbcb3e0ca902e40116c27d6fee7a389dd337bed2edfd107478cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3745e309e31adbcb3e0ca902e40116c27d6fee7a389dd337bed2edfd107478cf
SHA3-384 hash: 0462e361697a979b99842818a0cb74de79e5e9da5b369757956b10c5ce0e6d2555d1f6784653d9dad0619f263fce6bf8
SHA1 hash: 784aac9c6f5cf5110db46dc52633ad227a8a8545
MD5 hash: 23648952e6d43a8a01dd49bce631fb4a
humanhash: kilo-oscar-sink-pip
File name:SoundCloudUnblock.exe
Download: download sample
File size:70'590'284 bytes
First seen:2026-10-29 17:43:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash e3e80a143805ea18936c8f612e25d363 (4 x Adware.Techsnab, 3 x DarkStealer, 1 x AsyncRAT)
ssdeep 1572864:/4f/tu7Wc0XTHlwBXKxj8adoQuvG2uGPh/rfP6L0Mmp33S:Af1u0LlsXWwadkvGxGZfPW0npy
TLSH T1B1F7339AAD8038FAF1FE40359D5B950DF7F5310E136A019B13B419BE1CDB2D91EB8622
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon b6c9a7e1d4c02396
Reporter Alex_sev
Tags:agent exe Python salat SalatStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
NL NL
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c3715fd5-b3f4-4e1b-a086-2729245b9fea/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-29 17:50:48 UTC
Tags:
python auto-startup pyinstaller
Link:
https://app.any.run/tasks/fd6d2d7b-04fb-42ed-b93b-d120ebc516ac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae385cbb175ade21dce8424
Tags:
n/a
Verdict:
Suspicious
Labled as:
Malware_60.0
Link:
https://www.hybrid-analysis.com/sample/3745e309e31adbcb3e0ca902e40116c27d6fee7a389dd337bed2edfd107478cf
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-29T18:07:00Z UTC
Last seen:
2026-10-31T04:57:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/3745e309e31adbcb3e0ca902e40116c27d6fee7a389dd337bed2edfd107478cf/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1994843
Signature
Drops PE files with benign system names
Drops script or batch files to the startup folder
Found pyInstaller with non standard icon
Joe Sandbox ML detected suspicious sample
Sigma detected: Drops script at startup location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Potentially Suspicious Malware Callback Communication
Sigma detected: Suspect Svchost Activity
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1994843 Sample: SoundCloudUnblock.exe Startdate: 29/10/2026 Architecture: WINDOWS Score: 88 65 Sigma detected: Drops script at startup location 2->65 67 Sigma detected: Potentially Suspicious Malware Callback Communication 2->67 69 Sigma detected: System File Execution Location Anomaly 2->69 71 3 other signatures 2->71 8 SoundCloudUnblock.exe 198 2->8         started        12 cmd.exe 1 2->12         started        process3 file4 43 C:\Users\user\AppData\Local\...\zlib1.dll, PE32+ 8->43 dropped 45 C:\Users\user\AppData\Local\...\winsound.pyd, PE32+ 8->45 dropped 47 C:\Users\user\AppData\Local\...\win32pdh.pyd, PE32+ 8->47 dropped 49 109 other files (none is malicious) 8->49 dropped 79 Drops PE files with benign system names 8->79 81 Found pyInstaller with non standard icon 8->81 14 SoundCloudUnblock.exe 1 2 8->14         started        17 svchost.exe 198 12->17         started        19 conhost.exe 12->19         started        signatures5 process6 file7 51 C:\Users\user\AppData\Roaming\...\svchost.exe, PE32+ 14->51 dropped 21 svchost.exe 198 14->21         started        25 cmd.exe 1 14->25         started        53 C:\Users\user\AppData\Local\...\zlib1.dll, PE32+ 17->53 dropped 55 C:\Users\user\AppData\Local\...\winsound.pyd, PE32+ 17->55 dropped 57 C:\Users\user\AppData\Local\...\win32pdh.pyd, PE32+ 17->57 dropped 59 109 other files (none is malicious) 17->59 dropped 27 svchost.exe 1 17->27         started        process8 file9 35 C:\Users\user\AppData\Local\...\zlib1.dll, PE32+ 21->35 dropped 37 C:\Users\user\AppData\Local\...\winsound.pyd, PE32+ 21->37 dropped 39 C:\Users\user\AppData\Local\...\win32pdh.pyd, PE32+ 21->39 dropped 41 109 other files (none is malicious) 21->41 dropped 73 Drops script or batch files to the startup folder 21->73 75 Found pyInstaller with non standard icon 21->75 29 svchost.exe 3 21->29         started        33 conhost.exe 25->33         started        77 System process connects to network (likely due to code injection or exploit) 27->77 signatures10 process11 dnsIp12 63 77.239.96.159, 4444, 49743, 49745 NUXT-ASGB Germany 29->63 61 C:\Users\user\AppData\...\WindowsSecurity.bat, DOS 29->61 dropped file13
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3745e309e31adbcb3e0ca902e40116c27d6fee7a389dd337bed2edfd107478cf
Gathering data
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-29 17:43:44 UTC
File Type:
PE+ (Exe)
Extracted files:
1943
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g5c6gcpddln4wpqmveboiaiwyj6w73t2hco5gn562lw72edupdhq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery persistence privilege_escalation pyinstaller
Link:
https://tria.ge/reports/261029-watjta1wdz/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Reads the TCP/IP host and domain name from the registry
Creates a file in the Startup directory
Executes a file named after a Windows system binary
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments