🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c
SHA3-384 hash: 933a2fe471078dec37c5b1aeb5f6951e724c3f5b3459b95225c26cdcd11e793d7d4d17014b360cc8b9705be2000e2f6e
SHA1 hash: 65db9681e800ebd2af716972cfa0e2c3bf08ec0a
MD5 hash: 77c9f45ba9801e889db7195e36abef03
humanhash: crazy-eight-lake-romeo
File name:54e54se34sde45e4.exe
Download: download sample
File size:619'178 bytes
First seen:2026-10-27 18:43:51 UTC
Last seen:2026-10-27 19:17:55 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash e277f1464e7729ad9df5ec047611738a (2 x HijackLoader, 1 x AsyncRAT, 1 x GhostPulse)
ssdeep 12288:R3mgqnIZuYfCYqFet4CovkM7c6GnEIRAQRFehgtq:R3WnIZuMCxezot716BAQRFEOq
TLSH T106D48D32A5614033FBF10573B928A6303E7CE728275188A9D7D4AD1D7EB8482A7F7257
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon b2e1b496a6cada72 (14 x AsyncRAT, 13 x LummaStealer, 11 x HijackLoader)
Reporter miast0
Tags:exe RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
218
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-27 18:54:03 UTC
Tags:
auto-reg susp-lnk auto-startup arch-exec arch-scr qrcode
Link:
https://app.any.run/tasks/a8c2c7c2-5ead-47a0-b3e0-4ad63bc688a6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95534/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.14919789.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae0f1043a56bbccb37bf622
Tags:
dropper virus blic
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 CAB cmd evasive expired-cert findstr fingerprint installer installer lolbin microsoft_visual_cc obfuscated powershell timeout wix wscript
Link:
https://www.filescan.io/uploads/6ae0f100396843b93f40f381/reports/7576c206-eeca-4e81-a33b-7b7a9697cca6/overview
Verdict:
Malicious
Labled as:
JS_EtherRAT_A_trojan
Link:
https://www.hybrid-analysis.com/sample/4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-23T06:45:00Z UTC
Last seen:
2026-10-27T16:18:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/608d01cd-9681-4735-8b59-d012396dcc48
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1993173
Signature
Bypasses PowerShell execution policy
Creates autostart registry keys with suspicious names
Found suspicious powershell code related to unpacking or dynamic code loading
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1993173 Sample: 54e54se34sde45e4.exe Startdate: 27/10/2026 Architecture: WINDOWS Score: 100 106 nodejs.org 2->106 124 Malicious sample detected (through community Yara rule) 2->124 126 Multi AV Scanner detection for submitted file 2->126 128 Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet 2->128 130 2 other signatures 2->130 11 msiexec.exe 86 46 2->11         started        14 cmd.exe 2->14         started        17 54e54se34sde45e4.exe 3 2->17         started        19 output.exe 2->19         started        signatures3 process4 file5 90 C:\Users\user\AppData\Local\...\reggjwpps.vbs, ASCII 11->90 dropped 92 C:\Users\user\AppData\...\CompleteSetup.cmd, DOS 11->92 dropped 94 C:\Users\user\AppData\...\0ajzeIGKyHgn.tmp, ASCII 11->94 dropped 21 cmd.exe 1 11->21         started        150 Suspicious powershell command line found 14->150 152 Suspicious command line found 14->152 154 Wscript called in batch mode (surpress errors) 14->154 24 cmd.exe 14->24         started        26 conhost.exe 14->26         started        96 C:\Windows\Temp\...\54e54se34sde45e4.exe, PE32 17->96 dropped 28 54e54se34sde45e4.exe 31 24 17->28         started        31 output.exe 19->31         started        signatures6 process7 file8 132 Suspicious powershell command line found 21->132 134 Bypasses PowerShell execution policy 21->134 136 Suspicious command line found 21->136 33 cmd.exe 2 21->33         started        36 conhost.exe 21->36         started        138 Wscript called in batch mode (surpress errors) 24->138 38 wscript.exe 24->38         started        40 cmd.exe 24->40         started        42 cmd.exe 24->42         started        47 6 other processes 24->47 98 C:\Windows\Temp\...\output.exe, PE32 28->98 dropped 100 C:\Windows\Temp\...\wixstdba.dll, PE32 28->100 dropped 102 C:\Users\user\AppData\Local\...\output.exe, PE32 28->102 dropped 140 Creates autostart registry keys with suspicious names 28->140 44 output.exe 31->44         started        signatures9 process10 dnsIp11 114 Suspicious command line found 33->114 116 Wscript called in batch mode (surpress errors) 33->116 50 tar.exe 33->50         started        53 cmd.exe 1 33->53         started        56 wscript.exe 33->56         started        66 12 other processes 33->66 118 Windows Scripting host queries suspicious COM object (likely to drop second stage) 38->118 120 WScript reads language and country specific registry keys (likely country aware script) 38->120 58 AppLauncher.exe 38->58         started        122 Suspicious powershell command line found 40->122 60 powershell.exe 40->60         started        62 powershell.exe 42->62         started        104 C:\Users\user\AppData\Local\...\wixstdba.dll, PE32 44->104 dropped 112 104.16.212.131, 443, 49724 CLOUDFLARENET-CloudflareIncUS Canada 47->112 64 powershell.exe 47->64         started        file12 signatures13 process14 dnsIp15 82 C:\Users\user\AppData\Local\...\semver.js, a 50->82 dropped 84 C:\Users\user\AppData\Local\...\test_gyp.py, Python 50->84 dropped 86 C:\Users\user\AppData\Local\...\version.py, Python 50->86 dropped 88 51 other files (none is malicious) 50->88 dropped 142 Suspicious powershell command line found 53->142 69 powershell.exe 8 7 53->69         started        144 WScript reads language and country specific registry keys (likely country aware script) 56->144 72 AppLauncher.exe 56->72         started        74 conhost.exe 58->74         started        146 Found suspicious powershell code related to unpacking or dynamic code loading 60->146 108 nodejs.org 104.16.213.131, 443, 49719 CLOUDFLARENET-CloudflareIncUS Canada 66->108 110 127.0.0.1 unknown unknown 66->110 76 powershell.exe 7 66->76         started        78 powershell.exe 66->78         started        file16 signatures17 process18 signatures19 148 Found suspicious powershell code related to unpacking or dynamic code loading 69->148 80 conhost.exe 72->80         started        process20
Score:
7%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c
Verdict:
Malware
YARA:
5 match(es)
Tags:
CAB:COMPRESSION:MSZIP COM Behavior Trace DeObfuscated Executable Obfuscated PDB Path PE (Portable Executable) PE File Layout PowerShell SOS: 0.00 T1027 T1059 T1059.001 T1059.005 T1059.007 VBScript Win 32 Exe WScript.Shell x86
Link:
https://app.malva.re/file/77c9f45ba9801e889db7195e36abef03
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-23 16:23:01 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ivc3hqzqsnmkmv6u6sfeifzixuwn3uw7elifuio7s4zrd64rwaga._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/261027-xdlttaec65/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c
MD5 hash:
77c9f45ba9801e889db7195e36abef03
SHA1 hash:
65db9681e800ebd2af716972cfa0e2c3bf08ec0a
Link:
https://www.unpac.me/results/f583ac7a-c029-423a-bddc-3b6795f81e79/
SH256 hash:
08b9be97e004f15872645d037f87d5e69fe1eb512eb95590f2af6fdb9b460c75
MD5 hash:
5d65cdb43557906e8686e04d7b483d57
SHA1 hash:
1d64d20e2b2bc4a03da2447025bd5d16666cef4f
Link:
https://www.unpac.me/results/f583ac7a-c029-423a-bddc-3b6795f81e79/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/95534/

Comments