MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ca0c5add1a50bcddbc24eef272ae0c0feaf2fe07091613d3fde149ba255d40d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4ca0c5add1a50bcddbc24eef272ae0c0feaf2fe07091613d3fde149ba255d40d
SHA3-384 hash:	06520eae01115346b8f0bca690a4ed947c593e91abc9b13e9f2deb6bd79e2bd7b96071b02be805612068b52372ec88d0
SHA1 hash:	74dfcec233c3c9b138d17f837237aeb8776af4d1
MD5 hash:	2e62a6d1fb1e7f3f6240c52fd3739bd6
humanhash:	early-muppet-cat-equal
File name:	6eq5gvOfRvNmCi54.exe
Download:	download sample
File size:	2'988'032 bytes
First seen:	2026-08-11 07:59:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	44140cbbe125df54636c585913f74c75
ssdeep	49152:1Tvi7iBP6pIUur0oBOFyR/FmoDP0F8ibmcK5cjjJ5xAPDXVyl+l7vvGSwcO:CDxur0YmI/FnPiI5cREY63GSwb
TLSH	T17AD5239ABCB329B0D437C7B69D93F06D716A77958B308C8B39CD98104D225985C70BBB
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

134

Origin country :

SE

Vendor Threat Intelligence

ACCE VMProtect_Packer_PE

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3ba353f7-fa0a-49e5-9e61-252fe058bea9/

ANY.RUN xmrig

Malware family:

xmrig

Alert

Create hunting rule

ID:

1

File name:

bomb.exe

Verdict:

Malicious activity

Analysis date:

2026-08-11 07:29:08 UTC

Tags:

ip-check possible-phishing github stealer stealc xmrig miner generic loader botnet phorpiex auto nemucod solaris discord screenconnect remote amadey pikabot remus xworm evasion loda rat connectwise rmm-tool uac-bypass salatstealer python credentialflusher formbook quasar vidar sheet upx phantom ftp stego payload backdoor webshell inj3ctor3 jomangy phishing fakesite agenttesla

Link:

https://app.any.run/tasks/62fcddbb-860b-402f-b81e-f364dbbb2c8f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Gathering data

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Connection attempt

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a7ad6b5086bfd23460e3966/reports/c896f46c-9ad5-4a2d-ba2e-b137bf3eab52/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/4ca0c5add1a50bcddbc24eef272ae0c0feaf2fe07091613d3fde149ba255d40d

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f1264e41-00f4-401b-8712-22a424778e11

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1955703

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Creates / moves files in alternative data streams (ADS)

Creates an undocumented autostart registry key

Deletes itself after installation

Found direct / indirect Syscall (likely to bypass EDR)

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Suricata IDS alerts for network traffic

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/4ca0c5add1a50bcddbc24eef272ae0c0feaf2fe07091613d3fde149ba255d40d

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ca0c5add1a50bcddbc24eef272ae0c0feaf2fe07091613d3fde149ba255d40d/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jsqmlloruuf43w6cj3xsokxayd7k6l7aociwcpj73ykjxisv2qgq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/260811-jwnjgayglh/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Deletes itself

Executes dropped EXE

Registers new Windows logon scripts automatically executed at logon.

UnpacMe

Unpacked files

SH256 hash:

4ca0c5add1a50bcddbc24eef272ae0c0feaf2fe07091613d3fde149ba255d40d

MD5 hash:

2e62a6d1fb1e7f3f6240c52fd3739bd6

SHA1 hash:

74dfcec233c3c9b138d17f837237aeb8776af4d1

Link:

https://www.unpac.me/results/c4688782-2e4a-4a96-a513-1136eb3dd5ff/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 4ca0c5add1a50bcddbc24eef272ae0c0feaf2fe07091613d3fde149ba255d40d

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3894883/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/80237/