MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b00e47da69a554bb231c79aa49c0fd3dc44923b2c3780db95be456ec4eaf815. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b00e47da69a554bb231c79aa49c0fd3dc44923b2c3780db95be456ec4eaf815
SHA3-384 hash: f5522a9788a199b54853a91b507b2b2f1c8baa4ebe06660dd1d898d794e45c9ca6d82946ac0f324431e8141ffd169e04
SHA1 hash: eaacb781e556ce2e7e646ed6988b8006e9be119a
MD5 hash: b12d2a9655fc15b5ae9e6320a0dffa06
humanhash: virginia-edward-kilo-seventeen
File name:9z7BGnRGpgs8cZv7.exe
Download: download sample
File size:2'924'544 bytes
First seen:2026-08-08 20:54:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f5bec796b7b3c2932293afa8281cdeed
ssdeep 49152:IJRW4OJNt0BvFWCQWtPmUH8susV2loSX52/iVqLeGwlz/s1DUUkmwh82wjGIngL0:KOJaNWxAXaowAI8jwlTsUU082wHgkX8f
TLSH T1DBD52396B5F219B0C83BC7B18F01E4AE70687B898E258D4BB7CD55008E63658EC73772
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
SE SE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/3f6e8cc6-c324-40da-88a6-c805391feff4/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-08-08 21:03:30 UTC
Tags:
etherhiding
Link:
https://app.any.run/tasks/8f75c5e8-8532-4307-9169-36c81426959c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79321/
Detection(s):
SecuriteInfo.com.Win64.Evo-gen.85894584.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6a7797cee28890dd9cac9fbe/reports/533efce9-78c0-4088-83ab-2fc0d9264509/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4b00e47da69a554bb231c79aa49c0fd3dc44923b2c3780db95be456ec4eaf815
Verdict:
Unknown
File Type:
exe x64
Link:
https://opentip.kaspersky.com/4b00e47da69a554bb231c79aa49c0fd3dc44923b2c3780db95be456ec4eaf815/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/98dd3ebb-8db3-42fd-b858-fcd1634cce03
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1954494
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates / moves files in alternative data streams (ADS)
Deletes itself after installation
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Suricata IDS alerts for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1954494 Sample: 9z7BGnRGpgs8cZv7.exe Startdate: 08/08/2026 Architecture: WINDOWS Score: 100 38 polygon.gateway.tenderly.co 2->38 40 polygon.drpc.org 2->40 42 build.netbazaar.lol 2->42 54 Suricata IDS alerts for network traffic 2->54 56 Antivirus detection for URL or domain 2->56 58 Antivirus / Scanner detection for submitted sample 2->58 60 3 other signatures 2->60 9 9z7BGnRGpgs8cZv7.exe 11 2->9         started        13 UsoClient34ed49.exe 33 2->13         started        signatures3 process4 dnsIp5 32 C:\Users\user\AppData\...\UsoClient34ed49.exe, PE32+ 9->32 dropped 34 C:\...\UsoClient34ed49.exe:Zone.Identifier, ASCII 9->34 dropped 62 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->62 64 Creates / moves files in alternative data streams (ADS) 9->64 66 Uses schtasks.exe or at.exe to add and modify task schedules 9->66 68 Deletes itself after installation 9->68 16 UsoClient34ed49.exe 33 9->16         started        20 schtasks.exe 1 9->20         started        44 polygon.drpc.org 104.18.10.59, 443, 49766 CLOUDFLARENET-CloudflareIncUS Canada 13->44 70 Found direct / indirect Syscall (likely to bypass EDR) 13->70 22 schtasks.exe 1 13->22         started        file6 signatures7 process8 dnsIp9 36 polygon.gateway.tenderly.co 35.227.193.242, 443, 49764 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 16->36 46 Antivirus detection for dropped file 16->46 48 Multi AV Scanner detection for dropped file 16->48 50 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 16->50 52 Found direct / indirect Syscall (likely to bypass EDR) 16->52 24 schtasks.exe 1 16->24         started        26 conhost.exe 20->26         started        28 conhost.exe 22->28         started        signatures10 process11 process12 30 conhost.exe 24->30         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4b00e47da69a554bb231c79aa49c0fd3dc44923b2c3780db95be456ec4eaf815
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/b12d2a9655fc15b5ae9e6320a0dffa06
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b00e47da69a554bb231c79aa49c0fd3dc44923b2c3780db95be456ec4eaf815/
Threat name:
Win64.Trojan.Wacatac
Create hunting rule
Status:
Suspicious
First seen:
2026-08-08 20:56:05 UTC
File Type:
PE+ (Exe)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmaoi7ngtjkuxmrry6nkjhap2poejer3fq3ybw4vxzcw5rhk7akq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution persistence
Link:
https://tria.ge/reports/260808-zqr8gadm5z/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Deletes itself
Executes dropped EXE
Unpacked files
SH256 hash:
4b00e47da69a554bb231c79aa49c0fd3dc44923b2c3780db95be456ec4eaf815
MD5 hash:
b12d2a9655fc15b5ae9e6320a0dffa06
SHA1 hash:
eaacb781e556ce2e7e646ed6988b8006e9be119a
Link:
https://www.unpac.me/results/c1d096b6-c55b-4d1c-b607-dce72b8678c0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/4b00e47da69a554bb231c79aa49c0fd3dc44923b2c3780db95be456ec4eaf815

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 4b00e47da69a554bb231c79aa49c0fd3dc44923b2c3780db95be456ec4eaf815

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/79321/
  
URLhaus
https://urlhaus.abuse.ch/url/3894881/
  
Delivery method
Distributed via web download

Comments