MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LiquidRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057
SHA3-384 hash: e603c0630f09a52c5536ab8d1fa4552207e21f24b6d0b8c6956d140e3936e7f8fbe1cd97a591c46c4a22dc236a1153a5
SHA1 hash: 9913c632c82593b27cc3ff02864df2b0e0ac85e3
MD5 hash: 6121b0984b91213fa2dcdb2d4ce2e970
humanhash: video-alpha-georgia-four
File name:6121b0984b91213fa2dcdb2d4ce2e970.exe
Download: download sample
Signature LiquidRAT
Create hunting rule
File size:248'320 bytes
First seen:2026-08-28 19:49:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 57ef1b3ef61bbb72d48975720de53c54 (1 x LiquidRAT)
ssdeep 3072:VokbhwnYpC59d/E/+YhdWqzUC3ZhadSl7LCwNyLsCxUrAkJVYsNnAzS4Sbw:V5wYQ9BYhdWyq0xgarFnjk
TLSH T1FD345C1567A91CF9E977853DCD424906DB72BC5647B0EACF07A00A934F236E09E3EB12
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe LiquidRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
8b253d8b9a3d1d23483417036904898d
Verdict:
Malicious activity
Analysis date:
2026-08-26 14:44:35 UTC
Tags:
ip-check evasion loader uac
Link:
https://app.any.run/tasks/8526d3ba-63cc-4ad2-b776-e2cc7aa67f00

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83199/
Detection(s):
SecuriteInfo.com.Trojan.Siggen33.55210.12897.4298.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Launching a service
Deleting a recently created file
Launching a process
Creating a process with a hidden window
Searching for synchronization primitives
Creating a window
Сreating synchronization primitives
Changing a file
Enabling autorun with the shell\open\command registry branches
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug fingerprint microsoft_visual_cc
Link:
https://www.filescan.io/uploads/6a91e67cbf5459f61d542f62/reports/60cc0720-e1e0-4454-a190-5ffc70c8eb80/overview
Verdict:
Malicious
Labled as:
Capa_get_geographical_location
Link:
https://www.hybrid-analysis.com/sample/38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-08-25T16:06:00Z UTC
Last seen:
2026-08-29T14:42:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4df21337-2d3e-447f-a507-396e67069d1d
Result
Threat name:
n/a
Detection:
malicious
Classification:
adwa.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1965509
Signature
Antivirus detection for dropped file
Contain functionality to detect virtual machines
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to detect sandboxes (registry SystemBiosVersion/Date)
Contains functionality to detect sleep reduction / modifications
Contains functionality to determine the online IP of the system
Contains functionality to infect the boot sector
Contains functionality to inject threads in other processes
Drops PE files to the startup folder
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Bypass UAC via Fodhelper.exe
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
UAC bypass detected (Fodhelper)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1965509 Sample: 387YsM6ksM.exe Startdate: 28/08/2026 Architecture: WINDOWS Score: 100 101 wilsonrat.top 2->101 103 ip-api.com 2->103 105 api.ipify.org 2->105 113 Antivirus detection for dropped file 2->113 115 Multi AV Scanner detection for dropped file 2->115 117 Multi AV Scanner detection for submitted file 2->117 119 13 other signatures 2->119 10 387YsM6ksM.exe 2 15 2->10         started        15 WindowsUpdate.exe 2->15         started        17 winrt.exe 2->17         started        19 2 other processes 2->19 signatures3 process4 dnsIp5 111 wilsonrat.top 172.67.195.105, 443, 49726, 49727 CLOUDFLARENET-CloudflareIncUS Canada 10->111 97 C:\Users\user\AppData\Roaming\...\winrt.exe, PE32+ 10->97 dropped 129 UAC bypass detected (Fodhelper) 10->129 131 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->131 21 fodhelper.exe 12 10->21         started        99 C:\Users\user\AppData\Roaming\...\WinRT.exe, PE32+ 15->99 dropped 23 WinRT.exe 15->23         started        25 cmd.exe 17->25         started        27 cmd.exe 17->27         started        35 4 other processes 17->35 29 cmd.exe 19->29         started        31 cmd.exe 1 19->31         started        33 cmd.exe 19->33         started        37 7 other processes 19->37 file6 signatures7 process8 process9 39 winrt.exe 1 46 21->39         started        44 4 other processes 23->44 46 2 other processes 25->46 48 2 other processes 27->48 50 3 other processes 29->50 52 2 other processes 31->52 54 2 other processes 33->54 56 6 other processes 35->56 58 14 other processes 37->58 dnsIp10 107 ip-api.com 208.95.112.1, 49733, 49736, 49746 TUT-AS-TotalUptimeTechnologiesLLCUS United States 39->107 109 api.ipify.org 104.26.12.205, 443, 49732, 49734 CLOUDFLARENET-CloudflareIncUS Canada 39->109 93 C:\Users\user\AppData\...\WindowsUpdate.exe, PE32+ 39->93 dropped 95 C:\Users\user\AppData\Local\...\stealer.exe, PE32+ 39->95 dropped 121 Antivirus detection for dropped file 39->121 123 Multi AV Scanner detection for dropped file 39->123 125 Contains functionality to determine the online IP of the system 39->125 127 9 other signatures 39->127 60 cmd.exe 1 39->60         started        63 stealer.exe 39->63         started        65 cmd.exe 1 39->65         started        73 3 other processes 39->73 67 conhost.exe 44->67         started        69 schtasks.exe 44->69         started        71 conhost.exe 44->71         started        75 4 other processes 44->75 file11 signatures12 process13 signatures14 133 Uses schtasks.exe or at.exe to add and modify task schedules 60->133 77 conhost.exe 60->77         started        79 schtasks.exe 1 60->79         started        135 Multi AV Scanner detection for dropped file 63->135 81 conhost.exe 65->81         started        83 sc.exe 1 65->83         started        85 conhost.exe 73->85         started        87 sc.exe 1 73->87         started        89 conhost.exe 73->89         started        91 3 other processes 73->91 process15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/6121b0984b91213fa2dcdb2d4ce2e970
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057/
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-25 21:50:20 UTC
File Type:
PE+ (Exe)
AV detection:
23 of 36 (63.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hdw6bba7junrmhgcwhqik6et4wlnqq3qhkqwvxzszpp6g7raqblq._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/260828-ykejrasgkg/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Executes a command shell one-liner
Launches sc.exe
Adds Run key to start application
Looks up external IP address via web service
Maps connected drives based on registry
Checks computer location settings
Creates a file in the Startup directory
Disables service(s)
Executes dropped EXE
Stops running service(s)
Downloads MZ/PE file
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057
MD5 hash:
6121b0984b91213fa2dcdb2d4ce2e970
SHA1 hash:
9913c632c82593b27cc3ff02864df2b0e0ac85e3
Link:
https://www.unpac.me/results/b5ee5a6b-da0f-4149-bce3-7cdc76091b1f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/38ede0841f4d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/83199/

Comments