MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88
SHA3-384 hash:	796679ebcdccf9ca83106835211c400b0d4d1eaaf24f83fc4310b0a8704808afd137df89c54c07194cf8b7bcf235bfe4
SHA1 hash:	c3035ff9ee3fb9d222f7725fed7f7825adefc32e
MD5 hash:	c34229a38381e4ef1cdac65d57509247
humanhash:	july-early-nebraska-bluebird
File name:	53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88.exe
Download:	download sample
File size:	2'937'856 bytes
First seen:	2026-08-24 23:12:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	58f4b17816a07f7a36dd14e504d515e6
ssdeep	49152:Qp7/1Zpv+vI4xt097SgWDiZA6Jc3yXgJxHRvyBiFJ+oWBRIRczI+OSiE5JXGHlq:QpL1ZgRxt05SEt6CXqxHEzIlQGHl
TLSH	T157D52359AAF20474D437C7B18F92E07DB06A37858BA08E5BB39C3E105C635996D3B3B1
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	whack_sh
Tags:	exe whack.sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

131

Origin country :

US

Vendor Threat Intelligence

ACCE VMProtect_Packer_PE

Details

Link:

https://research.acce.ciphertechsolutions.com/results/32bf0678-4f48-4924-bc83-a14f85b71523/

ANY.RUN phorpiex

Malware family:

phorpiex

Alert

Create hunting rule

ID:

1

File name:

bomb.exe

Verdict:

Malicious activity

Analysis date:

2026-08-24 20:05:12 UTC

Tags:

ip-check screenconnect remote stealer stealc possible-phishing github phorpiex botnet phishing loader solaris remcos rat fakesite pastebin discord stego payload telegram pikabot auto generic sheet remus connectwise rmm-tool evasion miner qrcode arcticagent python xmrig amadey clipper diamotrix uac-bypass snappyclient nemucod phantom ftp rdp credentialflusher vidar powershell backdoor webshell inj3ctor3 jomangy hijackloader advancedinstaller tool purelogs agenttesla websocket susp-powershell winring0-sys vuln-driver etherhiding

Link:

https://app.any.run/tasks/0f5b10b5-4422-414c-86e4-3fb9e3d65a0f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/82678/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Creating a process from a recently created file

Creating a process with a hidden window

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Moving of the original file

Enabling autorun

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a8cd0070bea363f86471d81/reports/42f05522-f46f-4220-bd30-5ce6eebe606e/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-08-24T20:21:00Z UTC

Last seen:

2026-08-26T05:10:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88/results?tab=lookup

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9d620b45-2961-4d9d-9d42-f937ef73b683

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/c34229a38381e4ef1cdac65d57509247

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88/

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-24 23:13:28 UTC

File Type:

PE+ (Exe)

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kmlaulafga2a7kt5mixu4fc6vc52owxs6uhf3bpp7a4tuo7tjwea._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/260824-27fxwazydw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Deletes itself

Executes dropped EXE

Registers new Windows logon scripts automatically executed at logon.

UnpacMe

Unpacked files

SH256 hash:

53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88

MD5 hash:

c34229a38381e4ef1cdac65d57509247

SHA1 hash:

c3035ff9ee3fb9d222f7725fed7f7825adefc32e

Link:

https://www.unpac.me/results/331a49a7-8397-4183-889f-467cbe0b8fb0/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88

(this sample)

  

Delivery method

Distributed via web download

  

URLhaus

https://urlhaus.abuse.ch/url/3894883/

Cape

https://www.capesandbox.com/analysis/82678/