MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53bdb4aa4dfafe97c6edcaa5fcc602481d87c851c33bc438d404424467a99d73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SilentNet


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53bdb4aa4dfafe97c6edcaa5fcc602481d87c851c33bc438d404424467a99d73
SHA3-384 hash: d3a2aec4b9ba3d339391a10311096070f00c81937bd240c891f8c9753f875c3d52864f197eab89e861e7a5113732012b
SHA1 hash: 4fe831111019dbe84cf6a947d6c48c09ed26504d
MD5 hash: df38e902b736cbc534e356a62f7e2d53
humanhash: cup-don-april-winner
File name:Hackclient.exe
Download: download sample
Signature SilentNet
Create hunting rule
File size:1'138'688 bytes
First seen:2026-07-19 10:13:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 73f461c771aef77ec43d53a0c54f0c8d (20 x SilentNet)
ssdeep 12288:YZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGgvPqItNquB:Ycb4M06WpoPrwbvP3f5
TLSH T17E357C83EBE385D8C156C8B5534BF137F9627C8E4A157196ABC41E633E67B64E22CB00
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter burger
Tags:exe SilentNet

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
Hackclient.exe
Verdict:
Malicious activity
Analysis date:
2026-07-19 10:12:09 UTC
Tags:
python arch-exec arch-doc openssl tool arch-scr arch-html
Link:
https://app.any.run/tasks/fc9c6621-924f-47c3-a6ae-e1f476268c1a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75184/
Detection(s):
SecuriteInfo.com.Generic.Dacic.11262.24C12F2A.69152113.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5ca362bcffb2c48cb78095
Tags:
virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Launching a process
Creating a file
Moving a recently created file
Deleting a recently created file
Creating a process from a recently created file
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Delayed reading of the file
Using the Windows Management Instrumentation requests
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypto reconnaissance
Link:
https://www.filescan.io/uploads/6a5ca3586496ae75c5905dd1/reports/7a3aac34-d9da-4ec1-b017-0192bc446812/overview
Verdict:
Malicious
Labled as:
Dacic.11262.Generic
Link:
https://www.hybrid-analysis.com/sample/53bdb4aa4dfafe97c6edcaa5fcc602481d87c851c33bc438d404424467a99d73
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-19T07:08:00Z UTC
Last seen:
2026-07-21T01:39:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Win64.Convagent.gen HEUR:Trojan-Downloader.Win32.Magnar.gen
Link:
https://opentip.kaspersky.com/53bdb4aa4dfafe97c6edcaa5fcc602481d87c851c33bc438d404424467a99d73/results?tab=lookup
Malware family:
VoidLink
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eb0b1223-1069-4de8-b9ca-10961e2af4ee
Result
Threat name:
EtherHiding
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1944749
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious ZIP file
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Writes many files with high entropy
Writes to foreign memory regions
Yara detected EtherHiding
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1944749 Sample: Hackclient.exe Startdate: 19/07/2026 Architecture: WINDOWS Score: 100 80 www.python.org 2->80 82 thisisafalsepositive.st 2->82 84 7 other IPs or domains 2->84 116 Suricata IDS alerts for network traffic 2->116 118 Antivirus detection for URL or domain 2->118 120 Antivirus / Scanner detection for submitted sample 2->120 122 5 other signatures 2->122 10 Hackclient.exe 4 2->10         started        signatures3 process4 dnsIp5 86 rpc-mainnet.matic.quiknode.pro 150.136.141.142, 443, 49705, 49739 ORACLE-BMC-31898-OracleCorporationUS United States 10->86 88 polygon-rpc.com 198.178.224.35, 443, 49704, 49738 LATITUDE-SH-LatitudeshUS United States 10->88 124 Found direct / indirect Syscall (likely to bypass EDR) 10->124 14 python.exe 10->14         started        18 python.exe 10->18         started        21 python.exe 1088 10->21         started        23 6 other processes 10->23 signatures6 process7 dnsIp8 90 151.101.128.223, 443, 49729 FASTLY-FastlyIncUS Canada 14->90 62 C:\Users\user\AppData\Local\...\tmpmb7_qi5s, Zip 14->62 dropped 64 C:\Users\user\AppData\Local\...\tmpd_azp3ft, Zip 14->64 dropped 66 C:\Users\user\AppData\Local\...\tmpakjzcc94, Zip 14->66 dropped 72 513 other files (9 malicious) 14->72 dropped 40 2 other processes 14->40 92 151.101.128.175, 443, 49745 FASTLY-FastlyIncUS Canada 18->92 68 C:\Users\user\AppData\...\tmp_37fhfm9d.zip, Zip 18->68 dropped 74 34 other files (1 malicious) 18->74 dropped 104 Tries to harvest and steal browser information (history, passwords, etc) 18->104 106 Writes to foreign memory regions 18->106 108 Allocates memory in foreign processes 18->108 110 Creates a thread in another existing process (thread injection) 18->110 25 python.exe 18->25         started        28 pip.exe 18->28         started        30 cmd.exe 18->30         started        32 chrome.exe 18->32         started        94 151.101.0.223, 443, 49722 FASTLY-FastlyIncUS Canada 21->94 96 pypi.org 151.101.64.223, 443, 49721, 49727 FASTLY-FastlyIncUS Canada 21->96 76 381 other files (none is malicious) 21->76 dropped 112 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->112 114 Writes many files with high entropy 21->114 34 conhost.exe 21->34         started        98 dualstack.c.ssl.global.fastly.net 151.101.192.175, 443, 49711 FASTLY-FastlyIncUS Canada 23->98 100 dualstack.python.map.fastly.net 151.101.192.223, 443, 49708 FASTLY-FastlyIncUS Canada 23->100 102 2 other IPs or domains 23->102 70 C:\Users\user\AppData\Local\...\python.exe, PE32+ 23->70 dropped 78 33 other files (2 malicious) 23->78 dropped 36 conhost.exe 23->36         started        38 conhost.exe 23->38         started        42 4 other processes 23->42 file9 signatures10 process11 file12 54 C:\Users\user\AppData\Local\...\pip3.exe, PE32+ 25->54 dropped 56 C:\Users\user\AppData\Local\...\pip3.12.exe, PE32+ 25->56 dropped 58 C:\Users\user\AppData\Local\...\pip.exe, PE32+ 25->58 dropped 60 378 other files (none is malicious) 25->60 dropped 44 conhost.exe 25->44         started        46 python.exe 28->46         started        48 conhost.exe 28->48         started        50 conhost.exe 30->50         started        process13 process14 52 cmd.exe 46->52         started       
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/53bdb4aa4dfafe97c6edcaa5fcc602481d87c851c33bc438d404424467a99d73
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/df38e902b736cbc534e356a62f7e2d53
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53bdb4aa4dfafe97c6edcaa5fcc602481d87c851c33bc438d404424467a99d73/
Threat name:
Win64.Trojan.Convagent
Create hunting rule
Status:
Malicious
First seen:
2026-07-19 10:14:16 UTC
File Type:
PE+ (Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ko63jksn7l7jprxnzks7zrqcjaoypscrym54ioguarbeiz5jtvzq._file
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig defense_evasion discovery execution miner persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/260719-l9gn7abx61/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Modifies Windows Firewall
XMRig Miner payload
Family: xmrig
Unpacked files
SH256 hash:
53bdb4aa4dfafe97c6edcaa5fcc602481d87c851c33bc438d404424467a99d73
MD5 hash:
df38e902b736cbc534e356a62f7e2d53
SHA1 hash:
4fe831111019dbe84cf6a947d6c48c09ed26504d
Link:
https://www.unpac.me/results/5ce563e7-d634-4701-b1fe-6782a7c8a05c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.42
Link:
https://yomi.yoroi.company/submissions/53bdb4aa4dfafe97c6edcaa5fcc602481d87c851c33bc438d404424467a99d73

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/75184/

Comments