MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GLOBAL


Vendor detections: 14


Intelligence 14 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e
SHA3-384 hash: 9a40b8a7812dab4ec5d5e24d0df68c584b58bd16f3ecf066532f5997a148c443742299ca92f1874cbb7c1830556e664f
SHA1 hash: 8fccaf76aa9c6450da4ca9750c81d61a3318beed
MD5 hash: 16594656cf923af32ccdd0a7ab70e9ff
humanhash: island-robin-fish-twelve
File name:file
Download: download sample
Signature GLOBAL
Create hunting rule
File size:240'128 bytes
First seen:2026-01-05 14:01:49 UTC
Last seen:2026-01-05 15:38:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 934cf7ece072cb192e6f1696c5852040 (34 x GLOBAL)
ssdeep 6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9
Threatray 41 similar samples on MalwareBazaar
TLSH T12A347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:dropped-by-phorpiex exe global


Avatar
Bitsight
url: http://178.16.54.109/l13.exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
102
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e.exe
Verdict:
Malicious activity
Analysis date:
2026-01-05 14:04:26 UTC
Tags:
smb mamona ransomware
Link:
https://app.any.run/tasks/069bc8c5-237f-4c07-a750-e5af34b4caf1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/47741/
Detection(s):
SecuriteInfo.com.Trojan.Siggen31.51107.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=695bc471d2357cccc3dfa44e
Tags:
vmdetect
Result
Verdict:
Malware
Maliciousness:

Behaviour
Restart of the analyzed sample
Creating a process with a hidden window
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching a service
Creating a file in the system32 subdirectories
Creating a window
Searching for the window
Running batch commands
Creating a file
Changing a file
Modifies multiple files
Connection attempt
Moving a file to the system32 subdirectory
Replacing files
Launching a process
Network activity
Reading critical registry keys
Sending a custom TCP request
Searching for synchronization primitives
Sending an HTTP GET request
Forced shutdown of a system process
Creating a file in the mass storage device
Encrypting user's files
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-05T11:09:00Z UTC
Last seen:
2026-01-05T11:29:00Z UTC
Hits:
~10
Detections:
Trojan-Ransom.Win64.Agent.mona Trojan-Ransom.Win32.Encoder.sb Trojan-Ransom.Win32.Agent.sb Trojan.Win32.DelShad.sb Trojan.Win32.Agent.sb HEUR:Trojan-Ransom.Win64.Generic HEUR:Trojan-Ransom.Win32.Generic PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e/results?tab=lookup
Malware family:
GLOBAL
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e5df4bd0-0b63-4362-ae74-f2ff1f200924
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/16594656cf923af32ccdd0a7ab70e9ff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e/
Verdict:
Malicious
Threat:
Family.MAMONA
Link:
https://tip.neiki.dev/file/38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e
Threat name:
Win32.Ransomware.BlackLock
Create hunting rule
Status:
Malicious
First seen:
2026-01-05 14:02:21 UTC
File Type:
PE (Exe)
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hc4yewv66rns7opa567244jejgnpqw47gkgumgnmri326j2opnha._file
Verdict:
malicious
Label(s):
globalransomware
Create hunting rule
genericransomware
Create hunting rule
Similar samples:
23437efc7bf2f691678472e0080f4b22fa8e327d41781f95912ff6722a62f5fb
GLOBAL
4013d5545b490d4bdea2fbfc31cad82cd73e9d617ef5946ae9b9df19d6eada48
GLOBAL
823da032a4b7f64d6f3706f207d0f2a0cd44cd45b602193c4580403c2d4e8342
GLOBAL
8baadd5caf6014222b98656e875382126e719f53342591a47c29c408e10fbd60
GLOBAL
8ebb428ad35eceea596ffffc9bbf23b7ef3f09e4493eb894dade07eadb9f9652
GLOBAL
a858bbbfe1332816b23c8d46443b63f318958e6748c54e4b4040fd908d175d62
GLOBAL
e7ba958cac186815f76fbc5809e479000a5a569034fd0425bf0fb512ac523639
GLOBAL
error
GLOBAL
+ 31 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery ransomware
Link:
https://tria.ge/reports/260106-g9pbtadx7f/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in System32 directory
Sets desktop wallpaper using registry
Enumerates connected drives
Renames multiple (157) files with added filename extension
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7e4a5ba6-ca4a-4cb5-84e9-6181016e5b4b
Unpacked files
SH256 hash:
38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e
MD5 hash:
16594656cf923af32ccdd0a7ab70e9ff
SHA1 hash:
8fccaf76aa9c6450da4ca9750c81d61a3318beed
Link:
https://www.unpac.me/results/b2e3b1d8-6e16-4379-843e-0885f3b02536/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/38b9825abef4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICOUS_EXE_References_VEEAM
Create hunting rule
Author:ditekSHen
Description:Detects executables containing many references to VEEAM. Observed in ransomware
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GLOBAL

Executable exe 38b9825abef45b2fb9e0efbfae7124499af85b9f328d4619ac8a37af274e7b4e

(this sample)

  
Dropped by
Phorpiex
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3750754/
Cape
Cape
https://www.capesandbox.com/analysis/47741/

Comments