MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb
SHA3-384 hash: e915b550c55854fc34a87457e0292feb1fed503601f2f0070b44dd96fac4b695a1759dcb4c5106ea30c597e0cc6aa26f
SHA1 hash: ad84f68ba901c69728444813503b8957e381a008
MD5 hash: 1cf13d27e0d99a0a43a8aa3c8e4963bb
humanhash: hawaii-venus-violet-mobile
File name:file
Download: download sample
File size:3'570'504 bytes
First seen:2026-07-25 13:07:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5a4dce694935374774373ddc20cecc7e
ssdeep 12288:CNpbagVQBNf2CBZhb8053Q/+sIurwJ//F4k01+K4j6mEAc7oaQzC33333333333N:CNhayQiwZ58wUPrqik01+LlQ7op0Qx85
TLSH T163F52AA5C110F4FBE917BBB4855CADF992BA1C0DB7D42107961C744BC3631BA438EBA2
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 1030b2b27061694c
Reporter Bitsight
Tags:a dropped-by-gcleaner exe MIX7.file signed

Code Signing Certificate

Organisation:Environment Block Thumbnail Maker
Issuer:Environment Block Thumbnail Maker
Algorithm:sha256WithRSAEncryption
Valid from:2026-07-25T08:01:49Z
Valid to:2028-07-25T08:11:49Z
Serial number: 3afb22b3ba29c29b4701c2fc82a666d2
Thumbprint Algorithm:SHA256
Thumbprint: 3fc52090a37f5ffd33be2bd24cb9a9069ce9b03d44ea11c572b9e0b1f3d8e8f0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76083/
Detection(s):
SecuriteInfo.com.Variant.Downloader.Lazy.2.56176894.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a service
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
downloader expand lolbin mingw overlay packed signed
Link:
https://www.filescan.io/uploads/6a64b5248936871b28b89839/reports/77eed599-8ac3-400b-92b1-acdc3a6b3aad/overview
Verdict:
Malicious
Labled as:
Downloader.Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb
Verdict:
Unknown
File Type:
exe x64
First seen:
2026-07-25T12:38:00Z UTC
Last seen:
2026-07-25T13:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3f2340d5-3872-429e-8ecd-ba5099204b36
Score:
61%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/1cf13d27e0d99a0a43a8aa3c8e4963bb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb/
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-25 13:08:49 UTC
File Type:
PE+ (Exe)
Extracted files:
8
AV detection:
5 of 36 (13.89%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hm2yrxcamguiq4wnqylqqbbd5l3z2dfzexdevgistu3qbteqqdvq._file
Verdict:
malicious
Label(s):
Remus
Create hunting rule
Link:
https://reports.threatray.com/61b042f9-75db-43d1-a018-8ea56c0de476
Similar samples:
242507e13d2c7b486de8c841966b8cea3330b8452d4b0a75e4ebb045dccd7441
6b42326c8c8e747d00504e9072e9e742f53c9861d0d377a6b8f6e412c3518725
808fb4904d102f9ca6bc523db3be820d7614230f843ae128ddf86f946e8980f7
851afa6f3343202f7cf017e1b4e7ada2063132ad3e726c26fc33e1d657e24586
90bb3c411fffd0b0969cf9358658963c41ddc3b43ed7b957dad79db58d29e7e6
9add4b744ba1937057ff7b5a0e2b1e86e4a4cfff53faa012bd0f49d22dfdff7b
9d9636edabefb9940f5ae98f99c8c3adbe408a623d3db76824454aabec9a0731
9ec0777164bfb8981553f9beec161e092b05ffea560ef90d0d5333797eade5c2
d088dd1117ceb463164d766579e824eb0fcbb53b450bffcba16d8f8f57fac1dd
e54f398b81ea6cd06564536964e061bc0384607daa4a0ea577c502746fb4f745
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260725-qc3bvabk3y/
Unpacked files
SH256 hash:
3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb
MD5 hash:
1cf13d27e0d99a0a43a8aa3c8e4963bb
SHA1 hash:
ad84f68ba901c69728444813503b8957e381a008
Link:
https://www.unpac.me/results/4105268f-d285-4c21-b7c0-2475478637ba/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3b3588dc4061/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/76083/

Comments