MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57f8aec9d8eda1e279153ab74ca515107715ac01524820e5b9d7c734df00da81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 9 File information Comments

SHA256 hash:	57f8aec9d8eda1e279153ab74ca515107715ac01524820e5b9d7c734df00da81
SHA3-384 hash:	ef9a313cd0d21e640a326d030177f834595ac28665152e91cd5e8fcea53527dd4332a37b6d9a539071cf519d9eb943dc
SHA1 hash:	1fba31a248b4c18104566beb088baee86f3fca31
MD5 hash:	8bfce542d9e488aceabbc312ec81b806
humanhash:	sad-august-bacon-bluebird
File name:	file
Download:	download sample
File size:	1'192'448 bytes
First seen:	2026-10-20 05:05:22 UTC
Last seen:	2026-10-20 09:24:12 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	c6a3f0135d10b5a077cbbc96b42436ce
ssdeep	24576:jFhCL9SHtCWYJl2Qc7Xx0fxYwsIBEvlT:jFMRetCWFQcXxQaRvl
TLSH	T18345E051F69104C9D82E89FC42955A21AB3D39DF1B1058EF02781E06CF3A6D35BF6A3B
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	146896928a966814
Reporter	Bitsight
Tags:	dc2e5904be10c1f064ddfc0f4cca6898 dropped-by-Vidar exe

Bitsight

url: http://62.60.226.140/files/com/kliulij.exe

Intelligence

File Origin

# of uploads :

117

# of downloads :

205

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Suspicious activity

Analysis date:

2026-10-20 05:15:10 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/cde72a0d-f4c8-4620-8dee-84a598862507

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92995/

Detection(s):

SecuriteInfo.com.W64.Agent.NJT.gen.Eldorado.15205.28285.UNOFFICIAL

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad6f6b95a22ac805bd80a13

Tags:

emotet cobalt

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug fingerprint microsoft_visual_cc

Link:

https://www.filescan.io/uploads/6ad6f69991eca110395390e1/reports/f76b51a3-708b-45f5-afaa-7a70898227a6/overview

Verdict:

Malicious

Labled as:

Win64/Kryptik.HTB trojan

Link:

https://www.hybrid-analysis.com/sample/57f8aec9d8eda1e279153ab74ca515107715ac01524820e5b9d7c734df00da81

Verdict:

Unknown

File Type:

exe x64

First seen:

2026-10-21T20:15:00Z UTC

Last seen:

2026-10-21T20:36:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/57f8aec9d8eda1e279153ab74ca515107715ac01524820e5b9d7c734df00da81/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/6c326dc1-38e4-4ba2-891e-790bff973f13

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/57f8aec9d8eda1e279153ab74ca515107715ac01524820e5b9d7c734df00da81

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/8bfce542d9e488aceabbc312ec81b806

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/57f8aec9d8eda1e279153ab74ca515107715ac01524820e5b9d7c734df00da81/

Threat name:

Win64.Trojan.Ravartar

Status:

Suspicious

First seen:

2026-10-20 05:06:34 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k74k5soy5wq6e6ivhk3uzjivcb3rllabkjecbznz27dtjxya3kaq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware

Link:

https://tria.ge/reports/261020-fq5n1scz4z/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

System Time Discovery

Drops file in Program Files directory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Loads dropped DLL

Unpacked files

SH256 hash:

57f8aec9d8eda1e279153ab74ca515107715ac01524820e5b9d7c734df00da81

MD5 hash:

8bfce542d9e488aceabbc312ec81b806

SHA1 hash:

1fba31a248b4c18104566beb088baee86f3fca31

Link:

https://www.unpac.me/results/80248651-2827-4f16-a1f9-a16145d55ee1/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/57f8aec9d8ed/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/57f8aec9d8eda1e279153ab74ca515107715ac01524820e5b9d7c734df00da81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	JP_Lure_Content_Hunt Create hunting rule
Author:	sumeshi
Description:	Hunts for files containing Japanese kana text or common Japanese lure terminology

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Malware_SliverFox_ForgeAuto_c1e18461 Create hunting rule
Author:	Marjoriefort
Description:	Detects SliverFox (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_3ee43008 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 57f8aec9d8eda1e279153ab74ca515107715ac01524820e5b9d7c734df00da81

(this sample)

Dropped by

Vidar

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/92995/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample