🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505
SHA3-384 hash: bf0fbb6194766ccd4ef8e0e23d34d68545e0ecb838c860fa5e9146116f1bb285ef5b57b6c37d6f332586f0ac4d63fad6
SHA1 hash: 15f834ec853ed2ed88e3d30d4b482c58cb8dd50f
MD5 hash: 50f3e6ccab3d61281d04c64381994468
humanhash: bravo-william-oklahoma-butter
File name:49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505.bin
Download: download sample
File size:44'032 bytes
First seen:2026-09-23 01:01:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'499 x Formbook, 12'374 x SnakeKeylogger)
ssdeep 768:WUYQLdL89r+/OAtSM4mcG+TkZTZMfgld/0kplygKRU:WtQLdL89VUrcG+T8MMzEPW
TLSH T1B613BE6133FD8E21E6FF8B305A770315877ABD5A1A2AD79E198024684ED67088931B37
TrID 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.4% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon 96694dd4d4496996
Reporter whack_sh
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-09-23 01:10:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c7d55fb9-8dc1-4d31-bb76-a7cddb540736

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/88457/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint masquerade packed
Link:
https://www.filescan.io/uploads/6ab324e242d36623f953ba5a/reports/416d71b5-8b94-44fa-947d-a47601a58b23/overview
Verdict:
Suspicious
Labled as:
Malware_
Link:
https://www.hybrid-analysis.com/sample/49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505
Verdict:
Unknown
File Type:
exe x32
Link:
https://opentip.kaspersky.com/49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/577b99c4-9f49-4401-a637-1d470a4f5d7c
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1976486
Signature
.NET source code contains potential unpacker
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505
Verdict:
inconclusive
YARA:
8 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.27 Win 32 Exe x86
Link:
https://app.malva.re/file/50f3e6ccab3d61281d04c64381994468
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jgymjic7zvhfx7frgad6nsywws2zb5sdxduxyhvaz2rd3zeysucq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260923-bdejva1zbt/
Unpacked files
SH256 hash:
49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505
MD5 hash:
50f3e6ccab3d61281d04c64381994468
SHA1 hash:
15f834ec853ed2ed88e3d30d4b482c58cb8dd50f
Link:
https://www.unpac.me/results/18f08da1-a8da-402d-8a4a-d83787a4d8ba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 49b0c4a05fcd4e5bfcb13007e6cb16b4b590f643b8e97c1ea0cea23de4989505

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/88457/

Comments