MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37674c9dba76349a8f3298b36840966f929647a7b21e9a1c431b3b0afe6e98ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 11 File information Comments

SHA256 hash:	37674c9dba76349a8f3298b36840966f929647a7b21e9a1c431b3b0afe6e98ae
SHA3-384 hash:	795c27a4b5d99c123e8a62c7c0ffb24aeeabc72d9315aeb1bdebac30b86d3d9edd93f3bb22cd6aaff22047783c07bf7b
SHA1 hash:	31e04c3098ae108ac307900c12fbc70f0c260b2b
MD5 hash:	fe64326ea85e7a6c89dc1bee83e8878f
humanhash:	twenty-five-solar-south
File name:	July010725SwiftBNPParibas_VR84022_SE478943_HE489917_OD7749_VEA749_KY468_LOR9003.001
Download:	download sample
File size:	181'196 bytes
First seen:	2025-07-01 11:59:07 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	3072:rPUTCRQt2nVSHld+5d3GJt2F+3//TD94ULyZjqUWI2CYq:UCRq2n0HlEWtdvLHLyZz/
TLSH	T1300412E30F3D0BEC64359D0C412F7E478C0C2FC99E3AF7A2EB1560AB59949A69175C62
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	001 rar SWIFT

cocaman

Malicious email (T1566.001)
From: "Zenia Konstantopoulou <zkonstantopoulou@severtsonescreens.com>" (likely spoofed)
Received: "from office.severtsonescreens.com (office.severtsonescreens.com [104.168.135.60]) "
Date: "1 Jul 2025 05:59:00 +0200"
Subject: "LQ78361"
Attachment: "July010725SwiftBNPParibas_VR84022_SE478943_HE489917_OD7749_VEA749_KY468_LOR9003.001"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	July010725SwiftBNPParibas_VR84022_SE478943_HE489917_OD7749_VEA749_KY468_LOR9003.exe
File size:	555'768 bytes
SHA256 hash:	f7c073a96fdd57dc1a3f18e2e8ebb59c562c31037918e8dae7fc36c55eb1f49b
MD5 hash:	e153360dabfdb3511bac69a28242889e
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6863620b0fceda814b477944

Tags:

autorun virus micro msil

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 invalid-signature obfuscated signed stealer

Link:

https://www.filescan.io/uploads/6863cd9e7423ff017c395e2a/reports/d78fba6a-3554-4fce-ae65-d82cee8f549a/overview

Verdict:

Malicious

Labled as:

Trojan.Downloader

Link:

https://www.hybrid-analysis.com/sample/37674c9dba76349a8f3298b36840966f929647a7b21e9a1c431b3b0afe6e98ae

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

.Net Executable PE (Portable Executable) Rar Archive

Link:

https://app.malva.re/file/fe64326ea85e7a6c89dc1bee83e8878f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/37674c9dba76349a8f3298b36840966f929647a7b21e9a1c431b3b0afe6e98ae/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/37674c9dba76349a8f3298b36840966f929647a7b21e9a1c431b3b0afe6e98ae

Threat name:

ByteCode-MSIL.Trojan.Znyonm

Status:

Malicious

First seen:

2025-07-01 07:02:39 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g5tuzhn2oy2jvdzstczwqqewn6jjmr5hwipjuhcddm5qv7totcxa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/250701-n8rtwaal9x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Drops startup file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/37674c9dba76349a8f3298b36840966f929647a7b21e9a1c431b3b0afe6e98ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)