🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305
SHA3-384 hash: 781620f361b96d6107e73a33a9ea276979a1e8b55da11cd66349379cfa4178aa6e5aca630ba081fab926f81810b27646
SHA1 hash: d12f5a89e8cfbdb441694b6053776727fa38b292
MD5 hash: 8233dcb6e6d94b2263fa82877c80ecf0
humanhash: echo-one-nitrogen-snake
File name:4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305
Download: download sample
File size:861'184 bytes
First seen:2026-11-09 08:00:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'350 x AgentTesla, 20'845 x Formbook, 12'417 x SnakeKeylogger)
ssdeep 12288:/foe8B8NYv8HstfK0Q8mLnbk8KU3RsowuFIgc2ardRTmEHxxyrTCaV4UD/t7M:E8nH9Nbki3RhtFjv6CEHx+C
TLSH T17E05CF1827D80598F4FBF738513B560007F2FC4A9133D70EAE8588AD4D3EB95968AB67
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
36
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-11-09 12:29:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cd660c36-7a8f-4358-b9c6-3d37c3561e0b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/98218/
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Gathering data
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-09T14:44:00Z UTC
Last seen:
2026-11-04T19:04:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/81b0a58e-7384-4f07-b4f2-78a36bf8b6c7
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86
Link:
https://app.malva.re/file/8233dcb6e6d94b2263fa82877c80ecf0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-10-09 21:31:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jzpm7rwnjysiodvu3lcojheo633cmjc2cvsj3x5x67qda7ttkmcq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/261109-jxeb7aav8r/
Behaviour
System Location Discovery: System Language Discovery
.NET Reactor proctector
Malware Family:
n/a
Verdict:
Benign
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2f5a0270-7428-4833-80c6-a517748e16dc
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
peexe dotnet debugger-check exec-delay
Link:
https://intel.virussign.com/intelligence/file/4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305
Unpacked files
SH256 hash:
4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305
MD5 hash:
8233dcb6e6d94b2263fa82877c80ecf0
SHA1 hash:
d12f5a89e8cfbdb441694b6053776727fa38b292
Link:
https://www.unpac.me/results/bc7cca7f-aa82-4f4b-8504-16093b2b8d1a/
SH256 hash:
5de394df999f68f456bb667084cece6350d6100fd9b59279fe4a9507d2c89076
MD5 hash:
5593d332ef719bb437d2f9a1c7284964
SHA1 hash:
6647c218c26c7d526db1fa5051e611e9d5b054f9
Detections:
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/bc7cca7f-aa82-4f4b-8504-16093b2b8d1a/
Parent samples :
d6ff19d64c633bdbb85f7bdef972469d5fabf1e883fb21d13393765a9b741330
01d748f8fe167e13355ba570eacad9d6aea8e9df6d429c4e420354a9d2372c6b
dbc065b70b31021861dd5a62e9127e098a691027467516cbef867b4922c3647c
5d8908031799744f9a338728d759cb97849a8f6aa70048eb6654b41318b678d9
f5dc09d7de3886adf414d3d30a1f46545735cf009f7a4668a17140328976d311
a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4
a7dccc6132ec44a6e0fcf7b754a95a9264c8dceead99e59c534a00d785f7cea8
48072e7cf89702185b17f20400879d5d903d514296972b0c80758a4e46d8752c
59b744bbecfe7b6754f1fe56bced32bc3e6137f5ed862c6f51472a521e170c73
9b9b70f87e0c4cd60cb255ca914f5f5ddcaac7e0fbe9b266034021a555d48769
1891ee3368fdbe89c4c9dfec43d68b2fe0e87025e4bb7416928f87b4a3e6a6a0
4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98218/

Comments