MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 559d3969ebcf028eb5c9504b69f35f938718312c3c45ec9579a3b1a0b9ca97ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 559d3969ebcf028eb5c9504b69f35f938718312c3c45ec9579a3b1a0b9ca97ea
SHA3-384 hash: 7667e4d122524ca2e9ffe0330718e5165c1d841358231564f0c462d191ad7a43592b652f0ec2d341e9de9394997bbd1a
SHA1 hash: fe3bedd74317244aa32635c285fd82f0440044e8
MD5 hash: 59a6eea723080521744b6d3e144967ca
humanhash: december-delaware-mango-sierra
File name:Installer_v3477_x64.exe
Download: download sample
File size:19'288'064 bytes
First seen:2026-07-23 07:15:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a56f115ee5ef2625bd949acaeec66b76 (57 x Stealc, 57 x PureHVNC, 35 x CoinMiner)
ssdeep 393216:4kqHZhzZ0p1m0BTm3qSLIRKm1sInrnDKg2uPf:4kqHZEp1hhQEhbDh24
TLSH T1761733992C21ECD1C91934B2AB45A759B877CAACDFCB6C3233DA2C43473DE169C57488
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon cccccccccccccccc (8 x AgentTesla, 4 x Formbook, 2 x PureCrypter)
Reporter aachum
Tags:CNBackdoor exe


Avatar
iamaachum
https://dl89sfilesbase.top/downloads/Tgs2K0vDs7Z/Packed

CNBackdoor C2: https://tabbysbakescodes.ws/mnlinmwv/insirs.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75762/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Creating a file in the %temp% directory
Launching a process
Creating a process from a recently created file
Creating a window
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Running batch commands
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Unauthorized injection to a recently created process
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/559d3969ebcf028eb5c9504b69f35f938718312c3c45ec9579a3b1a0b9ca97ea
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-23T05:15:00Z UTC
Last seen:
2026-07-23T11:59:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/559d3969ebcf028eb5c9504b69f35f938718312c3c45ec9579a3b1a0b9ca97ea/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1946979
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found direct / indirect Syscall (likely to bypass EDR)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potential Privilege Escalation using Task Scheduler highest RunLevel
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected GenericBot
Yara detected MSIL Injector
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1946979 Sample: Installer_v3477_x64.exe Startdate: 23/07/2026 Architecture: WINDOWS Score: 100 76 tommysbakescodes.ws 2->76 78 tommysbakescodes.cv 2->78 80 2 other IPs or domains 2->80 88 Antivirus / Scanner detection for submitted sample 2->88 90 Multi AV Scanner detection for submitted file 2->90 92 Yara detected GenericBot 2->92 94 7 other signatures 2->94 11 Installer_v3477_x64.exe 2 2->11         started        15 wscript.exe 2->15         started        signatures3 process4 file5 72 C:\Users\user\...\IGHInstallHelper.exe, PE32+ 11->72 dropped 74 C:\Users\user\...\Installer_v3477_x64.exe.log, CSV 11->74 dropped 106 Detected unpacking (changes PE section rights) 11->106 108 Suspicious powershell command line found 11->108 110 Tries to detect sandboxes and other dynamic analysis tools (window names) 11->110 116 5 other signatures 11->116 17 powershell.exe 12 11->17         started        19 powershell.exe 23 11->19         started        112 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->112 114 WScript reads language and country specific registry keys (likely country aware script) 15->114 22 sysdata.exe 15->22         started        signatures6 process7 signatures8 24 IGHInstallHelper.exe 12 17->24         started        28 conhost.exe 17->28         started        96 Loading BitLocker PowerShell Module 19->96 30 WmiPrvSE.exe 19->30         started        32 conhost.exe 19->32         started        34 schtasks.exe 22->34         started        36 schtasks.exe 22->36         started        process9 file10 64 C:\Users\user\AppData\Roaming\...\sysdata.exe, PE32+ 24->64 dropped 66 C:\Users\user\AppData\Roaming\...\sdrsvc.dll, PE32+ 24->66 dropped 68 C:\Users\user\AppData\Roaming\...\DiagSvc.dll, PE32+ 24->68 dropped 70 C:\Users\user\AppData\Roaming\...\sysdata.vbs, ASCII 24->70 dropped 100 Antivirus detection for dropped file 24->100 102 Uses schtasks.exe or at.exe to add and modify task schedules 24->102 104 Potential Privilege Escalation using Task Scheduler highest RunLevel 24->104 38 sysdata.exe 14 3 24->38         started        42 cmd.exe 24->42         started        44 schtasks.exe 1 24->44         started        46 conhost.exe 34->46         started        48 conhost.exe 36->48         started        signatures11 process12 dnsIp13 82 tabbysbakescodes.ws 104.21.43.229, 443, 49722, 49726 CLOUDFLARENET-CloudflareIncUS Canada 38->82 84 api.ipify.org 104.26.12.205, 443, 49719, 49723 CLOUDFLARENET-CloudflareIncUS Canada 38->84 86 tommysbakescodes.ws 172.67.148.26, 443, 49720, 49721 CLOUDFLARENET-CloudflareIncUS Canada 38->86 98 Antivirus detection for dropped file 38->98 50 schtasks.exe 38->50         started        52 schtasks.exe 38->52         started        54 conhost.exe 42->54         started        56 timeout.exe 42->56         started        58 conhost.exe 44->58         started        signatures14 process15 process16 60 conhost.exe 50->60         started        62 conhost.exe 52->62         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/559d3969ebcf028eb5c9504b69f35f938718312c3c45ec9579a3b1a0b9ca97ea
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/559d3969ebcf028eb5c9504b69f35f938718312c3c45ec9579a3b1a0b9ca97ea/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kwots2plz4bi5nojkbfwt427sodrqmjmhrc6zflzuoy2books7va._file
Verdict:
malicious
Label(s):
PureCrypter
Create hunting rule
Link:
https://reports.threatray.com/fff2f76c-eb21-436a-9093-ff8f95e6a196
Similar samples:
200d998427ae5e0ea0a05cadd5ab2261258b047b6a976e1a25d6f81e1961ae3a
2012fa14729a5c0977e824b2937707002ee992865c6e171a023a5965090f71bd
2326fc72415a61e07ebf4e0c328f7b8a9d465de72ace9fbb4cc76ede5e5a0a2a
3c1ae82572bbf90ed03cec446a991ec34765c68e9cb0c64c896613fe4c1df2f6
3d006229cbe5f32f036b0f10ee2876a1d2e9434639c8ba934704d31f73688f0c
4a8751808fdf81e5819fd4c299bf1dd09547c938f63721e3820623bd8771a6cc
4fa631a1f53f2a220595072e1d6bc5c963a70be5ff9fd7cf2c47245e6f7d715b
8aa78ae6cd7d52921f44be77813c401a675cfa8b941f3c3368a57edfc03669d1
930df163cb5ea7e0b9a2ec3bdffd460a598cda23fe4bb8df5faf9bbeaad589f7
9c941b343d4406dd24f030679d7fa5b1096bfe9e277e98f7cfc2d74eb2eb7f61
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion execution persistence themida trojan
Link:
https://tria.ge/reports/260723-h3thmafp5s/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes a command shell one-liner
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Looks up external IP address via web service
Checks BIOS information in registry
Executes dropped EXE
Themida packer
Command and Scripting Interpreter: PowerShell
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
559d3969ebcf028eb5c9504b69f35f938718312c3c45ec9579a3b1a0b9ca97ea
MD5 hash:
59a6eea723080521744b6d3e144967ca
SHA1 hash:
fe3bedd74317244aa32635c285fd82f0440044e8
Link:
https://www.unpac.me/results/c877d0ff-e0d0-4ed4-8e16-07a425b24d6a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

iso 419e29d350c8e4d3430a42243f088b75a9f0e663b93826ba17369fb03b9eae8c

Executable exe 559d3969ebcf028eb5c9504b69f35f938718312c3c45ec9579a3b1a0b9ca97ea

(this sample)

  
Link
https://tria.ge/260723-hb2d6afk31/behavioral2
  
Dropped by
SHA256 419e29d350c8e4d3430a42243f088b75a9f0e663b93826ba17369fb03b9eae8c
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75762/
  
Dropped by
MD5 ca065de8832f80de8595757ac53b136e

Comments