MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41938903b5fa521e712d21fc0391b01d47370af4ce298fcda2de976088ba7bfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41938903b5fa521e712d21fc0391b01d47370af4ce298fcda2de976088ba7bfa
SHA3-384 hash: 07689d9d14adeb1e143de61486719dae2cc838d38be648fceb7a5f60de6b37bd731a34738a1072f2450d449a5864c0f9
SHA1 hash: c6a6bd5fd884b3c26da394c4cd87c56df73f11ed
MD5 hash: a1093a8ee80c8420208f2c08d7e00d45
humanhash: hawaii-sad-comet-east
File name:IY0IvT6.exe
Download: download sample
File size:3'693'056 bytes
First seen:2025-06-30 18:06:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:gVap/BCYJbTkoLxhThNPdawZ5nwLkT4irXSo:gQPxBhN1FZ5nLT4iTSo
TLSH T1A106C7E720C266EDC416C57F8723ED7E898FB1365616D8E3A094E2225D2ACC43776F09
TrID 38.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
393
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
IY0IvT6.exe
Verdict:
Malicious activity
Analysis date:
2025-06-30 18:24:26 UTC
Tags:
themida stealer
Link:
https://app.any.run/tasks/85482e92-3bf8-4b72-90f9-ca559e9a2913

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/11701/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.24642.29354.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6862d25d37c343677947e200
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/41938903b5fa521e712d21fc0391b01d47370af4ce298fcda2de976088ba7bfa
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d016b5b1-a3c2-41a4-a0e0-27642b6e7ff3
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1725826
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Detected unpacking (changes PE section rights)
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Leaks process information
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Tries to evade debugger and weak emulator (self modifying code)
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/41938903b5fa521e712d21fc0391b01d47370af4ce298fcda2de976088ba7bfa
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/a1093a8ee80c8420208f2c08d7e00d45
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41938903b5fa521e712d21fc0391b01d47370af4ce298fcda2de976088ba7bfa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=igjysa5v7jjb44jneh6ahenqdvdtocxuzyuy7tnc32lwbcf2pp5a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/250630-wqe2cshr7t/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Checks installed software on the system
Checks BIOS information in registry
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2727a372-d8dd-42e8-933f-a6c0dff67866
Unpacked files
SH256 hash:
41938903b5fa521e712d21fc0391b01d47370af4ce298fcda2de976088ba7bfa
MD5 hash:
a1093a8ee80c8420208f2c08d7e00d45
SHA1 hash:
c6a6bd5fd884b3c26da394c4cd87c56df73f11ed
Link:
https://www.unpac.me/results/f2a93d95-5930-4fae-b854-aa2aaad3a54a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41938903b5fa521e712d21fc0391b01d47370af4ce298fcda2de976088ba7bfa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 41938903b5fa521e712d21fc0391b01d47370af4ce298fcda2de976088ba7bfa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3571560/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/11701/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (NX_COMPAT)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments