🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec
SHA3-384 hash: 2aab915b2933ae3f332cbe5d2444b67f3a519904428bd208e55e094fcd9528dcced24d9fb542514cce0fc7e70351c3b0
SHA1 hash: 506a798263a37ffc2d30842881f62dd4aca7a416
MD5 hash: 5094236fe2a958565f415382a053642a
humanhash: michigan-oklahoma-skylark-sweet
File name:4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec.bin
Download: download sample
File size:16'139'208 bytes
First seen:2026-09-30 06:11:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 393216:rDec8y3DMK3znQLAc+r57RWwKkCIyrQNnpXjJfHzT+wANXzOWEPI:rDv9MKPco57cyIMZjJPX+n6/PI
TLSH T1A5F633B97DCCD18ED0F1E1DE1294EF72E168A68FEC35C9AAEC6C0B166509349F2C0255
Magika zip
Reporter whack_sh
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
US US
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:x2s443bc.cs1.exe
File size:16'644'528 bytes
SHA256 hash: c62cb66498344fc2374c0924d813711ff6fa00caea8581ae104c3c03b9233455
MD5 hash: cf2a00cda850b570f0aa6266b9a5463e
MIME type:application/x-dosexec
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a4ff028c-1941-467b-b605-b9652ea9cd5a/
Detection(s):
SecuriteInfo.com.Program.Unwanted.5218.27439.29022.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm crypto embarcadero_delphi expand expired-cert explorer fingerprint inno installer installer lolbin lolbin masquerade reconnaissance signed
Link:
https://www.filescan.io/uploads/6abca8407ba9d9ad771141e1/reports/b25a56c1-92e1-42bf-9d51-98629e553bcf/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec/results?tab=lookup
Score:
38%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/5094236fe2a958565f415382a053642a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-01-12 05:30:09 UTC
File Type:
Binary (Archive)
Extracted files:
857
AV detection:
6 of 23 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jkyshv4hxblo6hcusznhlry2r6oug6t53qdymtrqalemve3l6pwa._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
defense_evasion discovery installer persistence
Link:
https://tria.ge/reports/260930-m9arbazwgy/
Behaviour
Kills process with taskkill
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Adds Run key to start application
Downloads MZ/PE file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.84
Link:
https://yomi.yoroi.company/submissions/4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 4ab123d787b856ef1c54965a75c71a8f9d437a7ddc07864e3002c8ca936bf3ec

(this sample)

  
Delivery method
Distributed via web download

Comments