MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe
SHA3-384 hash: e9f36ac0bd4315d6b13d1811baaa7ca4c08ecba6fd32c468b41cf1ede0d058d374ab541ae6101c51a1efc7d7b64d85ea
SHA1 hash: aeb3ea75e1a510aa15a7d461ec98e0db58109198
MD5 hash: 77d0a7272c11c35ab21e93cef0c6ea4c
humanhash: steak-fourteen-lactose-bluebird
File name:file
Download: download sample
File size:299'008 bytes
First seen:2025-06-10 12:13:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e14388498639688dc750895bc5ef963a
ssdeep 3072:ynbF3Otaxatj0Q5QCD6DZTRBW4FQ9NAabGErvXmlQJJxoUDbgyu5OhclkOivN/TV:ygjl5QCuDlXW4+DiErv2yKU9pclkfNB
Threatray 17 similar samples on MalwareBazaar
TLSH T164544F5163E90664F1F77F30D97906226E377C859E3CC24E025095AE1EB2BA4EC78B63
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter jstrosch
Tags:exe X64


Avatar
jstrosch
Found at hxxp://rtost.duckdns[.]org/mimicr/TokenBorkerDll.exe by #subcrawl

Intelligence

File Origin
# of uploads :
1
# of downloads :
408
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
No threats detected
Analysis date:
2025-06-10 16:37:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/847e0d09-39eb-4ec6-891d-2d263874eda9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/8820/
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.52729.13652.25456.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6848219d07b5e8c1cfe61a47
Tags:
dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe
Malware family:
NSSM
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1069ddda-b831-47ef-a271-ef00d811fb34
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1710877
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe
Threat name:
Win64.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2024-03-21 11:48:34 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
17 of 36 (47.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jupgqkzcmmx2v7ttawcm44slwyfnhbfcw2lu7zpxf2o7o2zujo7a._file
Verdict:
malicious
Label(s):
admintool_nssm
Create hunting rule
Similar samples:
4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87
4b0b811922ef54485f8bb75aaadeedf70f173d56d958d5b980b8abcaaefb6540
4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe
5d31ded12c6a8943f96522d5353af0d3bbb9a5ee81cef07db1c14c7cc0f117c6
778999ec7de998a62cf77f6b0ac379915e31093c4753c00629bfd51160fb2150
9b6c23ee51101f9e2542bb697e7b218e0a57d51ac6b577998cba351581aa7491
c605c90af10dbc8033e7f4d9aa6f999583a419d699907a14d8d72d08ffdb9e4c
error
+ 7 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250610-ped7csxny9/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2b26aa84-6926-4d41-8dd1-bcc73e250221
Unpacked files
SH256 hash:
4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe
MD5 hash:
77d0a7272c11c35ab21e93cef0c6ea4c
SHA1 hash:
aeb3ea75e1a510aa15a7d461ec98e0db58109198
Link:
https://www.unpac.me/results/748d2b02-f6ef-4d8a-9830-6bf5f5aa7e85/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/8820/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetSidLengthRequired
ADVAPI32.dll::GetSidSubAuthorityCount
ADVAPI32.dll::GetSidSubAuthority
ADVAPI32.dll::InitializeSid
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::GetSidIdentifierAuthority
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::FillConsoleOutputAttribute
KERNEL32.dll::FillConsoleOutputCharacterW
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleA
KERNEL32.dll::FreeConsole
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetWindowsDirectoryW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ChangeServiceConfig2W
ADVAPI32.dll::ChangeServiceConfigW
ADVAPI32.dll::ControlService
ADVAPI32.dll::CreateServiceW
ADVAPI32.dll::GetServiceDisplayNameW
ADVAPI32.dll::GetServiceKeyNameW

Comments