🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fbbf0d94f1140ffde0bdd48c5b07f91f2292fae78b227e48a50b60ed624763b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


INC


Vendor detections: 14


Intelligence 14 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fbbf0d94f1140ffde0bdd48c5b07f91f2292fae78b227e48a50b60ed624763b
SHA3-384 hash: cbce3e098cfe6ba4066d8f787d73206dde491c683897c33709b27e4f29b58b9394f2a6ef4da6c881096e9c71c1958a6f
SHA1 hash: 20f86b0f9da8f7195e634340bbe37bc269651082
MD5 hash: e018f1fda39d199926f4fb083f7148d3
humanhash: eighteen-tennessee-georgia-texas
File name:winrar-x64-713es.exe
Download: download sample
Signature INC
Create hunting rule
File size:4'210'688 bytes
First seen:2025-08-30 09:54:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9da7080b9b697496fd4f41997e8bd436 (1 x INC, 1 x HVNC, 1 x RemcosRAT)
ssdeep 98304:k2wrYNO6rDwYRwHLGLTNMBaZByGFXB+g0sibSFVR:kTYDHGrOTgWMsiK
TLSH T12D16336A67E88469F0869776C8F79287E5377C6773A2CBEF4354D12A0D326C14930B32
TrID 51.7% (.EXE) InstallShield setup (43053/19/16)
19.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.6% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.4% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon f8f0f4c8c8c8d8f0 (8'804 x RedLineStealer, 5'109 x Amadey, 288 x Smoke Loader)
Reporter burger
Tags:exe INC Lynx Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
632
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
winrar-x64-713es.exe
Verdict:
Malicious activity
Analysis date:
2025-08-30 09:51:31 UTC
Tags:
lynx ransomware sinobi ransomware upx
Link:
https://app.any.run/tasks/4fd8b4d7-ad9b-4f28-b807-2ab0e65196ce

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/24216/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b2ca65eb163e0ec18324cb
Tags:
dropper spawn
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-vm CAB explorer fingerprint installer lolbin lolbin microsoft_visual_cc overlay packed rundll32 runonce sfx threat
Link:
https://www.filescan.io/uploads/68b2cacd6212e2f74265dfe5/reports/92651c68-72cd-44cf-aece-3240cc988902/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/4fbbf0d94f1140ffde0bdd48c5b07f91f2292fae78b227e48a50b60ed624763b
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-08-30T06:48:00Z UTC
Last seen:
2025-08-30T06:48:00Z UTC
Hits:
~10
Detections:
Trojan-Ransom.Win32.Agent.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/4fbbf0d94f1140ffde0bdd48c5b07f91f2292fae78b227e48a50b60ed624763b/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2024654e-e1d4-4e9d-9bb1-6fa38fcbffa1
Result
Threat name:
Lynx
Create hunting rule
Detection:
malicious
Classification:
rans.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1768083
Signature
Antivirus / Scanner detection for submitted sample
Changes the wallpaper picture
Contains functionalty to change the wallpaper
Creates multiple autostart registry keys
Document exploit detected (process start blacklist hit)
Found potential ransomware demand text
Found ransom note / readme
Found Tor onion address
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Creation of an WerFault.exe in Unusual Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Writes many files with high entropy
Yara detected Lynx Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1768083 Sample: winrar-x64-713es.exe Startdate: 30/08/2025 Architecture: WINDOWS Score: 100 66 Antivirus / Scanner detection for submitted sample 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 Found ransom note / readme 2->70 72 7 other signatures 2->72 9 winrar-x64-713es.exe 1 4 2->9         started        13 ONENOTE.EXE 2->13         started        15 onenoteim.exe 2->15         started        18 3 other processes 2->18 process3 dnsIp4 58 C:\Users\user\AppData\Local\...\winrshost.exe, PE32+ 9->58 dropped 60 C:\Users\user\...\winrar-x64-713es.exe, PE32+ 9->60 dropped 86 Creates multiple autostart registry keys 9->86 20 winrshost.exe 1 3 9->20         started        24 winrar-x64-713es.exe 1 48 9->24         started        26 OfficeC2RClient.exe 13->26         started        64 ln-0007.ln-msedge.net 150.171.22.17, 443, 49725 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 15->64 file5 signatures6 process7 file8 48 C:\Users\user\AppData\...\FileCoAuth.exe, PE32+ 20->48 dropped 82 Multi AV Scanner detection for dropped file 20->82 84 Creates multiple autostart registry keys 20->84 28 FileCoAuth.exe 1 3 20->28         started        50 C:\Program Files\WinRAR\Zip32.sfx, PE32 24->50 dropped 52 C:\Program Files\WinRAR\Zip.sfx, PE32+ 24->52 dropped 54 C:\Program Files\WinRAR\WinRAR.exe, PE32+ 24->54 dropped 56 11 other files (none is malicious) 24->56 dropped 32 Uninstall.exe 1 24->32         started        signatures9 process10 file11 62 C:\Users\user\AppData\Local\...\WerFault.exe, PE32 28->62 dropped 88 Multi AV Scanner detection for dropped file 28->88 90 Creates multiple autostart registry keys 28->90 34 WerFault.exe 411 28->34         started        signatures12 process13 file14 40 DiagnosticLogCSP_C..._48.etl.LYNX (copy), DOS 34->40 dropped 42 DiagnosticLogCSP_C...23_10_3_8_56_48.etl, DOS 34->42 dropped 44 C2RManifest.Lync.L...one.xml.LYNX (copy), DOS 34->44 dropped 46 96 other files (94 malicious) 34->46 dropped 74 Multi AV Scanner detection for dropped file 34->74 76 Contains functionalty to change the wallpaper 34->76 78 Found potential ransomware demand text 34->78 80 4 other signatures 34->80 38 conhost.exe 34->38         started        signatures15 process16
Score:
88%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4fbbf0d94f1140ffde0bdd48c5b07f91f2292fae78b227e48a50b60ed624763b
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
CAB:COMPRESSION:LZX Executable PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) Win 64 Exe x64
Link:
https://app.malva.re/file/e018f1fda39d199926f4fb083f7148d3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fbbf0d94f1140ffde0bdd48c5b07f91f2292fae78b227e48a50b60ed624763b/
Verdict:
Malicious
Threat:
Trojan-Ransom.Win32.Agent
Link:
https://tip.neiki.dev/file/4fbbf0d94f1140ffde0bdd48c5b07f91f2292fae78b227e48a50b60ed624763b
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-08-30 09:54:19 UTC
File Type:
PE+ (Exe)
Extracted files:
129
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j657bwkpcfap7xql3vemlmd7shzcsl5opczcpzekkc3a5vreoy5q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/250830-lyjz6s1ky9/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Adds Run key to start application
Executes dropped EXE
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/29983674-d024-4fd8-a9ec-ca3c394a4bd9
Unpacked files
SH256 hash:
4fbbf0d94f1140ffde0bdd48c5b07f91f2292fae78b227e48a50b60ed624763b
MD5 hash:
e018f1fda39d199926f4fb083f7148d3
SHA1 hash:
20f86b0f9da8f7195e634340bbe37bc269651082
Link:
https://www.unpac.me/results/ce57cf10-f59d-4350-8388-730a90bf41e4/
SH256 hash:
01eaab6a082ab12f9227568d841405bf4764f1aa93cfda285edacee5b81dedac
MD5 hash:
49fd5e4a41745bbf95973b7638ba7c9a
SHA1 hash:
ebeda78118d32653749bab049736a628c0e730de
Link:
https://www.unpac.me/results/ce57cf10-f59d-4350-8388-730a90bf41e4/
SH256 hash:
0d6b63ab2cf10c9b55eabc046580fcbf36c85f9459d3c2316493315674aadc72
MD5 hash:
a2a9c5bd002410b68795f5be7bedb50a
SHA1 hash:
8e9fd99f246d303958bd77fbbafe41ba8ebc18c1
Link:
https://www.unpac.me/results/ce57cf10-f59d-4350-8388-730a90bf41e4/
SH256 hash:
35f19a7939c45f2d14f1a31823ee70fb1e09dae4ee896ea89758ad8e0ed42fca
MD5 hash:
2bed6333645461eb151a320ed56a1d81
SHA1 hash:
1c72df946a12c59bd5e2a2da871569fa1f6bd690
Link:
https://www.unpac.me/results/ce57cf10-f59d-4350-8388-730a90bf41e4/
SH256 hash:
3c7ea2144b1738b30e3c2e1ba952684eb43c704a5ae82a4dd492d607a42c517c
MD5 hash:
120508bcf2e91c722b832b7ac7772a01
SHA1 hash:
bc2590bf89f44ef9c79b3920020ec524fcf4e0d1
Link:
https://www.unpac.me/results/ce57cf10-f59d-4350-8388-730a90bf41e4/
SH256 hash:
69a7d8df7e07eeadefbeadca2832f7753cb8912ea2c1ba0a7ca595ddb122e0f6
MD5 hash:
8d3813b62631489be7b9021b3263d1c4
SHA1 hash:
74369391cf315d153d2df9a4e52579e97276256a
Link:
https://www.unpac.me/results/ce57cf10-f59d-4350-8388-730a90bf41e4/
SH256 hash:
e9b0b6833ee4b2874f43595cf77177bd48a22d322fe0fa9f3bbabeedf1d04789
MD5 hash:
82dfc9fc59c4dc8df08357b6fd828978
SHA1 hash:
f4b688606c1718c702f10ed19bc7d70b7024a22b
Link:
https://www.unpac.me/results/ce57cf10-f59d-4350-8388-730a90bf41e4/
Malware family:
Lynx
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4fbbf0d94f11/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4fbbf0d94f1140ffde0bdd48c5b07f91f2292fae78b227e48a50b60ed624763b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MAL_RANSOM_INC_Aug24
Create hunting rule
Author:X__Junior
Description:Detects INC ransomware and it's variants like Lynx
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/24216/

Comments