MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 13

Intelligence 13 IOCs YARA 8 File information Comments

SHA256 hash:	41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517
SHA3-384 hash:	e80e42e04300726d748df12db0425c3c0d3327645e882daffe26a78df5972ad3b6dbe7974d7e95e3a1ef2077347bc6d1
SHA1 hash:	10295176ec685a412f0eae7a108d70571f9cec3f
MD5 hash:	a3348ecd59f7ce4fddaa84cd144ffb8e
humanhash:	monkey-india-sink-pennsylvania
File name:	random.exe
Download:	download sample
File size:	2'089'171 bytes
First seen:	2025-08-09 09:50:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	12e12319f1029ec4f8fcbed7e82df162 (388 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep	49152:IBJPTpc8iYMUCYcY2NcZYJS+d1VP/S+Yn9WRGsX7IbC:yBTFMUbcH6Gfd1pUn9WRGXbC
Threatray	2'854 similar samples on MalwareBazaar
TLSH	T1D1A52312B9C584F2D0671C739E65A721A97DBD105F76CECB93E1161EDA20DC0EB30BA2
TrID	89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.5% (.EXE) Win64 Executable (generic) (10522/11/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	abuse_ch
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

_41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517.exe

Verdict:

No threats detected

Analysis date:

2025-08-09 10:01:12 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2e5ee98c-6567-4608-98a5-94ca32d0faa7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/19878/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68971a2c11d7f9b979e6e8b9

Tags:

injection dropper obfusc

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Creating a file

Verdict:

Malicious

Labled as:

Trojan.Rasftuby.Generic

Link:

https://www.hybrid-analysis.com/sample/41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a81a37a9-7caa-4952-bbd0-a4aa302a4129

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

42 / 100

Link:

https://www.joesandbox.com/analysis/1753633

Signature

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/a3348ecd59f7ce4fddaa84cd144ffb8e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517/

Verdict:

Malicious

Threat:

Trojan.BAT.Starter

Link:

https://tip.neiki.dev/file/41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517

Threat name:

Win32.Trojan.Rasftuby

Status:

Malicious

First seen:

2025-08-09 00:57:52 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=igcx4so2s7b6yfxxapq7zeqiazjtt7xplgfjz4zgexnwaayhaulq._file

Verdict:

malicious

Label(s):

unc_loader_051

682f31b0bbe6f30fb67f5e07d6579241307694116a2cce4397e6a995bc5c8529

72567a2d2a7931d46ad2c62f87207a2ee60b8c7c237db6f542a28d8a56708f11

8e0276e632229e8b49886b83e67d523921402fec40a8de209c4d1438feb56c1e

d63fbd5d295808c22813cb17b72371e3f292addde9da2bdff2ca0bc225f17b1f

d88ee06812199ed7d3a407454167cb95b00b57f9857f6bc0b987b9e78926ed20

dae14369784dab2d59505db3a2c7ba39d7add7eadbe249ae9a9cda14fb133afc

error

fc372a2941ceaebf8988abfa8ffaee141918c6a1a1849d95896d1e474c961395

+ 2'844 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250809-lw4xkacl8s/

Behaviour

System Location Discovery: System Language Discovery

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/96bc5f4b-23d6-4330-b1b9-270e5d4c1f29

Unpacked files

SH256 hash:

41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517

MD5 hash:

a3348ecd59f7ce4fddaa84cd144ffb8e

SHA1 hash:

10295176ec685a412f0eae7a108d70571f9cec3f

Link:

https://www.unpac.me/results/e3eccd53-2a4b-44a5-84bb-cd29181b76d8/

SH256 hash:

dae45af0f593f84fce9412497715003832398572cbd29693f3041a32f22530e7

MD5 hash:

989b9eccbebf8b39fe136b79421e5687

SHA1 hash:

d08f926694b79bcedba152c02470483577548c30

Link:

https://www.unpac.me/results/e3eccd53-2a4b-44a5-84bb-cd29181b76d8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	dcrat_ Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked dcrat malware samples.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SelfExtractingRAR Create hunting rule
Author:	Xavier Mertens
Description:	Detects an SFX archive with automatic script execution

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 41857e49da97c3ec16f703e1fc9208065339feef598a9cf32625db6003070517

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3593478/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/19878/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipAlloc
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AllocConsole KERNEL32.dll::AttachConsole KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample