MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5421cbe85c61a3aef71b108e8b24c44aa62049e4bbea96b9786ea1c0c9e811fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 11
| SHA256 hash: | 5421cbe85c61a3aef71b108e8b24c44aa62049e4bbea96b9786ea1c0c9e811fd |
|---|---|
| SHA3-384 hash: | 87efc3b0f3a8c6821f6e91355931a3517df059702d3d9e092141cf6d902d709ffeca31955c08d4adadd40dc3bedf5574 |
| SHA1 hash: | 35b9e6249d5ae561baed46affc0870d721119580 |
| MD5 hash: | bea47104d8dcc5cdd7a3464c49c90883 |
| humanhash: | iowa-georgia-golf-robert |
| File name: | 5421cbe85c61a3aef71b108e8b24c44aa62049e4bbea96b9786ea1c0c9e811fd |
| Download: | download sample |
| File size: | 2'973'696 bytes |
| First seen: | 2026-10-19 07:55:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/vnd.microsoft.portable-executable |
| imphash | 58f4b17816a07f7a36dd14e504d515e6 |
| ssdeep | 49152:DT2CHLx5zhvkWp+M3kpo8k+FtS2MJDtz+KpL/gMPGelSUxb0SzHvu3wtX:DhHLpkWn3kpDFtg+K/H+elnx9T |
| TLSH | T1F6D522977DF61871C436C7B68FC3E5BEB168778547208E8B7ACC2A004E522196C367B9 |
| TrID | 33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
134
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Suspicious activity
Analysis date:
2026-10-19 09:57:04 UTC
Tags:
websocket
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
92.5%
Tags:
malware
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating synchronization primitives
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Connection attempt to an infection source
Sending a custom TCP request
Sending an HTTP GET request
DNS request
Connection attempt
Moving of the original file
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-09-06T18:00:00Z UTC
Last seen:
2026-09-11T15:44:00Z UTC
Hits:
~100
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Threat name:
Win64.Packed.Generic
Status:
Suspicious
First seen:
2026-09-06 19:22:40 UTC
AV detection:
17 of 24 (70.83%)
Threat level:
1/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
defense_evasion discovery persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Reads the TCP/IP host and domain name from the registry
Deletes itself
Executes dropped EXE
Registers new Windows logon scripts automatically executed at logon.
Unpacked files
SH256 hash:
5421cbe85c61a3aef71b108e8b24c44aa62049e4bbea96b9786ea1c0c9e811fd
MD5 hash:
bea47104d8dcc5cdd7a3464c49c90883
SHA1 hash:
35b9e6249d5ae561baed46affc0870d721119580
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 5421cbe85c61a3aef71b108e8b24c44aa62049e4bbea96b9786ea1c0c9e811fd
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.