MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54395c2ae81e3504904906ac117fd94101e6850e840397972b4f6623cff510e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54395c2ae81e3504904906ac117fd94101e6850e840397972b4f6623cff510e6
SHA3-384 hash: 62dd7fbdd25921100f50fdb4c2edce18ec7d33f319daa98752d4c0f1e82d74a92844da859199d5e7fb2762aecb47cf8e
SHA1 hash: a888d696ac47786c199b9dd6af29c735afd86a06
MD5 hash: 4aabcd0fe543b306aa07c48371c75474
humanhash: tennis-maryland-venus-victor
File name:msedge_elf.dll
Download: download sample
File size:3'113'456 bytes
First seen:2025-11-25 17:32:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0951d9f67c9a9e1b6ea746ed01bccc26 (18 x Rhadamanthys, 4 x Vidar, 1 x AmateraStealer)
ssdeep 49152:lGPQG6BTMCT9U78cvO/SzEABlH3O1z8wpqe/:lobB1s8Je/
Threatray 457 similar samples on MalwareBazaar
TLSH T1E0E5590EEDB085A6F05DA2355CB6D2823F37B884373623D31A2266792FF66D09837715
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter JAMESWT_WT
Tags:booking empowerhouseproject-org exe signed Spam-ITA

Code Signing Certificate

Organisation:www.tripadvisor.com
Issuer:GlobalSign RSA OV SSL CA 2018
Algorithm:sha256WithRSAEncryption
Valid from:2025-07-01T12:47:06Z
Valid to:2026-06-28T21:16:07Z
Serial number: 14d630316bb7edeca4d4ce6e
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 08a15539491535dd1ea4bc491650ea35b92c4554d362a9225d574ffd5bc15e55
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
https://surveyservicesemmy.com/apscont
Verdict:
Malicious activity
Analysis date:
2025-11-25 17:24:56 UTC
Tags:
susp-clipboard clickfix anti-evasion arch-exec rat asyncrat remote stealer
Link:
https://app.any.run/tasks/7e025846-e29c-452b-bf77-d18caf21ff40

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/41479/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6925e8645d7fac83ebf2ec44
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/54395c2ae81e3504904906ac117fd94101e6850e840397972b4f6623cff510e6
Verdict:
Malicious
File Type:
dll x64
First seen:
2025-11-25T14:58:00Z UTC
Last seen:
2025-11-27T03:21:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Inject.sb Trojan.MSIL.Agent.sb PDM:Trojan.Win32.Generic Backdoor.MSIL.AsyncRat.iw
Link:
https://opentip.kaspersky.com/54395c2ae81e3504904906ac117fd94101e6850e840397972b4f6623cff510e6/results?tab=lookup
Malware family:
Orchid Security
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cc9b0004-ed03-4c64-b1c7-0f238f3221a1
Score:
91%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/54395c2ae81e3504904906ac117fd94101e6850e840397972b4f6623cff510e6
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/4aabcd0fe543b306aa07c48371c75474
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54395c2ae81e3504904906ac117fd94101e6850e840397972b4f6623cff510e6/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/54395c2ae81e3504904906ac117fd94101e6850e840397972b4f6623cff510e6
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-11-25 17:33:27 UTC
File Type:
PE+ (Dll)
Extracted files:
2
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kq4vykxidy2qjecja2wbc76ziea6nbioqqbzpfzlj5tcht7vcdta._file
Verdict:
malicious
Label(s):
unc_loader_078
Create hunting rule
Similar samples:
14f8ff92c7bc84e9d50fc0c7d6df09642d10fb928c2edb20953c9aa8fd3e5dc8
55b3ec4ebfe1a2765ecbb18c84b9e70779774d56ab42778b09e83f02e3df7934
8403705f9ec24cbede1aaa9982a0649aea928c66a5d41d7f47ba04701cea8f18
99978bb92355f3b3436b8e28f416d787bafd523deae3f03c97e0d9ed292e0305
b6e0fb10c486aae7779fe8e7a93b314dcbcdd6f0afaa30820699941604d28b1d
c56eada17d6c1dc11aef7339b2976be7fd74fbc531d1ffe360ee144316681f72
e17f553220905c179fb636a60e8cac9b29f2fb67d41cf86d8cef8a7c24e5d936
eb791e76b50623254498d8d618de706f1f4ae0e26aa72726fd3704441a13f998
error
f43c4b3b64ec48a6a22a17045a174a737ae194ceb8b3f3bbdb23d53e5a2382af
+ 447 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/251125-v411bafq8y/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/204fded6-1a4c-4dd2-9cf0-903c602af544
Unpacked files
SH256 hash:
54395c2ae81e3504904906ac117fd94101e6850e840397972b4f6623cff510e6
MD5 hash:
4aabcd0fe543b306aa07c48371c75474
SHA1 hash:
a888d696ac47786c199b9dd6af29c735afd86a06
Link:
https://www.unpac.me/results/8ce717ec-de4b-4d21-ba11-6418355a3cb0/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/54395c2ae81e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.29
Link:
https://yomi.yoroi.company/submissions/54395c2ae81e3504904906ac117fd94101e6850e840397972b4f6623cff510e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/41479/

Comments