MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39c69cb0f29f8e9f41fa305cb1adf34762e5d8131ae348553b089377236c4f38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	39c69cb0f29f8e9f41fa305cb1adf34762e5d8131ae348553b089377236c4f38
SHA3-384 hash:	a3031c4db1766f916c91aeb6b79201928f036979b3e31c5899b4c27b1616b4a1efca9171d9345e8fa1e4e9e982dc286c
SHA1 hash:	936b0aa520ef5ad9c5ad14a306a4e95eacf65600
MD5 hash:	083316688a2a0e61f45c74a953053f55
humanhash:	pip-magazine-oscar-violet
File name:	wczt-win-8.1.65-x64 (1).exe
Download:	download sample
Signature	CobaltStrike Alert Create hunting rule
File size:	98'980'978 bytes
First seen:	2026-08-06 12:58:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	027ea80e8125c6dda271246922d4c3b0 (10 x njrat, 7 x DCRat, 5 x DarkComet)
ssdeep	1572864:yP4pZrq7QRumfRdoHH02GlqJiyai8Hlup/ivrO3C90cbGlSWj/0wRHsHnjSRzfsk:yPwZreIMHklUaiavE20cKlSzwRHsDSqk
TLSH	T17B28331099D699F6D0012AB89C987E621B37C4471DE5DE3F879C7A1E4CF07258A23EBC
TrID	22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win64 Executable (generic) (6522/11/2) 17.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.7% (.EXE) Win32 Executable (generic) (4504/4/1) 7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	cdabae6fe6e7eaec (22 x Amadey, 9 x AurotunStealer, 8 x CoinMiner)
Reporter	Ling
Tags:	Cobalt Strike CobaltStrike exe SilverFox ValleyRAT

CNGaoLing

SilverFox / CobaltStrike
IOC (Domain dm.dohida.us) (Domain dm.telegrem.store) (Domain xjsjkjdsjjd.s3.ap-southeast-1.amazonaws.com) (IP 118.107.43.16:1688)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

435

Origin country :

US

Vendor Threat Intelligence

ACCE Rar_SFX

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7f9b4c1b-ae5e-4f57-aaa3-cb6e85534949/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-08-06 13:10:40 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/00d27faa-7645-49e1-a3d1-3e3f697a3e10

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac15d9e1d23979d00c5cb19

Tags:

virus

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug base64 crypto evasive expired-cert fingerprint installer installer installer-heuristic keylogger microsoft_visual_cc overlay packed packed reconnaissance sfx

Link:

https://www.filescan.io/uploads/6a7484fb26411371370d1dea/reports/8c52b851-22e7-4cfb-9d19-948852c05ad9/overview

Hybrid Analysis Bladabindi.BH

Verdict:

Malicious

Labled as:

Bladabindi.BH

Link:

https://www.hybrid-analysis.com/sample/39c69cb0f29f8e9f41fa305cb1adf34762e5d8131ae348553b089377236c4f38

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-08-06T09:30:00Z UTC

Last seen:

2026-08-06T10:27:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/39c69cb0f29f8e9f41fa305cb1adf34762e5d8131ae348553b089377236c4f38/results?tab=lookup

Nucleon Malprob Susipicious

Score:

33%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/39c69cb0f29f8e9f41fa305cb1adf34762e5d8131ae348553b089377236c4f38

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Downloader.Generic

Threat name:

Win32.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-06 13:01:29 UTC

File Type:

PE (Exe)

Extracted files:

7990

AV detection:

10 of 24 (41.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hhdjzmhst6hj6qp2gboldlpti5rolwatdlruqvj3bcjxoi3mj44a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/260806-p7tshswsgz/

Behaviour

Suspicious use of SetWindowsHookEx

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.