MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5683b2ec28666619005b44b16285b3a23e24849163cd604df2200db64beb0f2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 14 File information Comments

SHA256 hash:	5683b2ec28666619005b44b16285b3a23e24849163cd604df2200db64beb0f2f
SHA3-384 hash:	3d22273ab09ab6ae3ca4796a01cfb090e4881893d61b73a0fcce1a15f2019ef6f69fdefd4b2b74ad69e3892fd6ec7cbd
SHA1 hash:	86e2ad1c0c32e3799e2ffe8feacad93c7d171aec
MD5 hash:	a772059c63eaaf12d86e93e6f6a4728e
humanhash:	robert-hamper-mirror-utah
File name:	cdns-daemon.exe
Download:	download sample
File size:	246'784 bytes
First seen:	2026-10-04 17:02:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	81cac0fe0a04177f3c3293d4442e6d12
ssdeep	6144:l11jE5Lo4wPI4Ph8YcedpRtfNdEtGZt/li/:lPE5LCjPhgepTNdEcli/
TLSH	T1E1345D039E45A9E8DC77C578569A9232A6B23C21C731F4DF1B90DB152D23BC0BB3AB45
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	Alex_sev
Tags:	exe Loader Psw stealer

Intelligence

File Origin

# of uploads :

# of downloads :

234

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-04 17:11:14 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f07de7d4-f0d2-4182-a840-41fd6d45f3e6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/90630/

Detection(s):

MiscreantPunch.SingleXOR.EXE.167.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6acf51646f551121ba150c7d

Tags:

infosteal emotet

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm crypto evasive expand explorer fingerprint hacktool lolbin obfuscated reconnaissance xor-pe xor-pe

Link:

https://www.filescan.io/uploads/6ac286da18cfebc995e138c9/reports/36771bea-cf4d-4386-b3c4-4f1227a4f8b7/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/5683b2ec28666619005b44b16285b3a23e24849163cd604df2200db64beb0f2f

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-02T10:43:00Z UTC

Last seen:

2026-10-06T14:02:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/5683b2ec28666619005b44b16285b3a23e24849163cd604df2200db64beb0f2f/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/39d347a4-3426-4ab0-a585-3c9bd1cbcc27

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/5683b2ec28666619005b44b16285b3a23e24849163cd604df2200db64beb0f2f

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/a772059c63eaaf12d86e93e6f6a4728e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5683b2ec28666619005b44b16285b3a23e24849163cd604df2200db64beb0f2f/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-04 17:03:28 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

10 of 24 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k2b3f3bimztbsac3isywfbntui7cjbermpgwatpseag3ms7lb4xq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261004-vkvn7asfqc/

Unpacked files

SH256 hash:

5683b2ec28666619005b44b16285b3a23e24849163cd604df2200db64beb0f2f

MD5 hash:

a772059c63eaaf12d86e93e6f6a4728e

SHA1 hash:

86e2ad1c0c32e3799e2ffe8feacad93c7d171aec

Detections:

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Link:

https://www.unpac.me/results/2414639b-9338-4d03-814d-2a7eee9269a9/

SH256 hash:

d4aaef8b861dc429e508bccee402d0275834336e6e8d0de26c99b6448363b2ba

MD5 hash:

44f874c288287ec447da6d8775bc533c

SHA1 hash:

9e555e256dc1fca06d5eff16601a9b19a244226c

Link:

https://www.unpac.me/results/2414639b-9338-4d03-814d-2a7eee9269a9/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5683b2ec28666619005b44b16285b3a23e24849163cd604df2200db64beb0f2f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Malware_Unknown_ForgeAuto_3ee43008 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/90630/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample