MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87
SHA3-384 hash: 5cd0f09eca2dde705e8a589251de7bf1f59bedeb2f20990f0d2b27ebc598c1c289ed2ec196281b6aa09d97f0cd915d12
SHA1 hash: 1bde24c472fc4e7b59db115abf13db6b60509bcb
MD5 hash: eecfb62b663f4ef60037a637924df4bd
humanhash: delaware-eleven-juliet-william
File name:file
Download: download sample
File size:299'008 bytes
First seen:2025-06-10 12:13:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e14388498639688dc750895bc5ef963a
ssdeep 3072:yNbF3Otaxatj0Q5QCD6DZTRBW4FQ9NAabGErvXmlQJJxoUDbgyu5OhclkOivN/TV:yWjl5QCuDlXW4+DiErv2yKU9pclkfNB
Threatray 11 similar samples on MalwareBazaar
TLSH T112544F5163E90664F1F77F30D97906226E377C859E3CC24E025095AE1EB2BA4EC78B63
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter jstrosch
Tags:exe X64


Avatar
jstrosch
Found at hxxp://rtost.duckdns[.]org/mimicr/TokenBorkerCFG.exe by #subcrawl

Intelligence

File Origin
# of uploads :
1
# of downloads :
404
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
No threats detected
Analysis date:
2025-06-10 16:37:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/91c744fa-6e2e-40ec-8d15-c8c08edc50d1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/8819/
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.52729.5280.23560.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6848219b8bd5d68a12e7783e
Tags:
dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87
Malware family:
NSSM
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/2dfcf1dc-04e6-4842-95b9-7e297e354699
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1710882
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87
Threat name:
Win64.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2024-03-04 17:41:36 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jkhczjpvuzohhy7jcdigwv3avmmbo7uu2dni6dd6yiwk5zaevsdq._file
Verdict:
malicious
Label(s):
admintool_nssm
Create hunting rule
Similar samples:
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
2401c15ca787d7143719e3e28c06d54034fad38352138ce48c082fb79d5859be
4b0b811922ef54485f8bb75aaadeedf70f173d56d958d5b980b8abcaaefb6540
5d31ded12c6a8943f96522d5353af0d3bbb9a5ee81cef07db1c14c7cc0f117c6
9b6c23ee51101f9e2542bb697e7b218e0a57d51ac6b577998cba351581aa7491
c605c90af10dbc8033e7f4d9aa6f999583a419d699907a14d8d72d08ffdb9e4c
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
error
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250610-ped7csxny8/
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/547e0448-556f-4180-a2ee-b079825ae47b
Unpacked files
SH256 hash:
4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87
MD5 hash:
eecfb62b663f4ef60037a637924df4bd
SHA1 hash:
1bde24c472fc4e7b59db115abf13db6b60509bcb
Link:
https://www.unpac.me/results/419cdee5-dc94-4e2a-9072-8ab4be0ff9f6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/8819/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetSidLengthRequired
ADVAPI32.dll::GetSidSubAuthorityCount
ADVAPI32.dll::GetSidSubAuthority
ADVAPI32.dll::InitializeSid
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::GetSidIdentifierAuthority
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::FillConsoleOutputAttribute
KERNEL32.dll::FillConsoleOutputCharacterW
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleA
KERNEL32.dll::FreeConsole
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetWindowsDirectoryW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ChangeServiceConfig2W
ADVAPI32.dll::ChangeServiceConfigW
ADVAPI32.dll::ControlService
ADVAPI32.dll::CreateServiceW
ADVAPI32.dll::GetServiceDisplayNameW
ADVAPI32.dll::GetServiceKeyNameW

Comments