MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41017ef33c83c29f2bd537d541689fd8e05fac4c6cb2166e66d2a2237bdfbb89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	41017ef33c83c29f2bd537d541689fd8e05fac4c6cb2166e66d2a2237bdfbb89
SHA3-384 hash:	2cf54865a548cb9fa2955327c1c87c78b41dc273d7fce3e1705d69852c838adabe0a558de32cd7e0ff620d187c957b4a
SHA1 hash:	f120b9c90697643f61444ced34793aa9aa55b4d2
MD5 hash:	67b5e83bb55a02be52b3cdd5b9276add
humanhash:	dakota-king-wolfram-oklahoma
File name:	shadowrocket-1.3.4-win64-setup.exe
Download:	download sample
File size:	84'681'527 bytes
First seen:	2026-08-28 18:11:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	94074edde4a60220eafe1ff3023e26e6
ssdeep	1572864:9e6sSH3yOawt+Yi2ShQlkukW6e71aH6ammvJjQj8OL:88HqwUYir7uMS1aHJ/vJj/OL
TLSH	T1E308E15772E41498E47AC0398B278503EBB1BC1A1330ABEB16B0B6552F77EF1597E321
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	084d1616b20e080a
Reporter	Alex_sev
Tags:	exe fakevpn

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

172

Origin country :

NL

Vendor Threat Intelligence

ACCE MurmurHash3_128x86

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d8c12874-66ee-4432-bbec-1bacfbb27474/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

shadowrocket-1.3.4-win64-setup.exe

Verdict:

Malicious activity

Analysis date:

2026-08-21 16:12:44 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/1d629bdb-2528-4d8b-979a-80830b7c5f89

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a file in the %temp% directory

Creating a file

Launching a process

Searching for synchronization primitives

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug anti-vm crypto crypto datper expand expired-cert exploit fingerprint installer keylogger lolbin microsoft_visual_cc overlay packed packed reconnaissance reconnaissance

Link:

https://www.filescan.io/uploads/6a91cf91a7e47ff1e3a8e496/reports/fbda38ce-86ae-40fe-a309-432da25e1a15/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/41017ef33c83c29f2bd537d541689fd8e05fac4c6cb2166e66d2a2237bdfbb89

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

exe x64

First seen:

2026-08-28T16:03:00Z UTC

Last seen:

2026-08-28T16:46:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/41017ef33c83c29f2bd537d541689fd8e05fac4c6cb2166e66d2a2237bdfbb89/results?tab=lookup

Nucleon Malprob Benign

Score:

19%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/41017ef33c83c29f2bd537d541689fd8e05fac4c6cb2166e66d2a2237bdfbb89

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ieax54z4qpbj6k6vg7kuc2e73dqf7lcmnszbm3tg2krcg667xoeq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

defense_evasion execution

Link:

https://tria.ge/reports/260828-wtfr3adg64/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Hide Artifacts: Ignore Process Interrupts

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.