MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5b288132f126e009d486f2125b1b7cdb126ae2fa55a96bcebaf9dcc20f0acd1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 5b288132f126e009d486f2125b1b7cdb126ae2fa55a96bcebaf9dcc20f0acd1e |
|---|---|
| SHA3-384 hash: | 78998272ac7adf27635b41e86a9e47c2d99287cf06144d0febfe4d28e32ce2f8f07def34154fdaa0098739ba02a50c79 |
| SHA1 hash: | 5de0c8879ebc0a6f6fdd293d8bdefef9b4b90809 |
| MD5 hash: | 82511fcfa1162c971127a9063175e67e |
| humanhash: | zebra-golf-echo-minnesota |
| File name: | 5b288132f126e009d486f2125b1b7cdb126ae2fa55a96bcebaf9dcc20f0acd1e.exe |
| Download: | download sample |
| File size: | 4'843'804 bytes |
| First seen: | 2026-10-02 10:13:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f4d1e4cd7416ef83f79f7c6a038875b3 (2 x ConnectWise, 2 x ValleyRAT) |
| ssdeep | 98304:j14Qqbr99DxJrB+uqDAEvXg5NuSIpO0l0fssNhSYuBRPfQ:jC9v3PqcEP6und0EouBRPfQ |
| TLSH | T1E926335E9E019EE5F30AC4392675D4B6487A7DF8E45F1295DE830D328C3B780FE6A206 |
| TrID | 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | c4dadadad2f492c2 (149 x GuLoader, 55 x RemcosRAT, 23 x VIPKeylogger) |
| Reporter |  whack_sh |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
199
Origin country :
USVendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Suspicious activity
Analysis date:
2026-10-02 10:16:30 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a window
Сreating synchronization primitives
Gathering data
Verdict:
Suspicious
Labled as:
Malware
Verdict:
Unknown
File Type:
exe x32
First seen:
2026-10-02T07:30:00Z UTC
Last seen:
2026-10-02T07:36:00Z UTC
Hits:
~10
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
suspicious
Classification:
mine
Score:
26 / 100
Signature
Antivirus detection for URL or domain
Found strings related to Crypto-Mining
Behaviour
Behavior Graph:
Score:
91%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
defense_evasion discovery trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks installed software on the system
Loads dropped DLL
Unpacked files
SH256 hash:
5b288132f126e009d486f2125b1b7cdb126ae2fa55a96bcebaf9dcc20f0acd1e
MD5 hash:
82511fcfa1162c971127a9063175e67e
SHA1 hash:
5de0c8879ebc0a6f6fdd293d8bdefef9b4b90809
SH256 hash:
6f13a663f25891b9815b737b5b3bdce647616266b6a73eed655d9f6ccb865cfc
MD5 hash:
56ceb29d91706a3e7a050a130ba8e657
SHA1 hash:
68e072f473077b175262479f30bf177b635d8d60
SH256 hash:
0cee4c182ea92b2e7bce942db990e5bd88ab6f8927704209817d04cfab25cf1f
MD5 hash:
94bed44c269786f8f99db87819171975
SHA1 hash:
6f29a1b26d31d49037a4fca2e704f5cafef97423
SH256 hash:
5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 hash:
948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 hash:
75197fee3c6a814fe035788d1c34ead39349b860
SH256 hash:
1a3b738901baf1c82b37c7ee683cc31f2fabb518941eb876e3ef2257ff49653b
MD5 hash:
fe336b0f31a4353a7956058ebccffe5c
SHA1 hash:
99bc776ca80f436844603df1f9412924b9ffb626
SH256 hash:
dfa02ad29e171ba94e2ed1cf67fb125d4b976bfe6ef2258fc2666d811c7e7ff0
MD5 hash:
603fc3c0741ebb52d480e254bfe725b9
SHA1 hash:
b09a8a1fe852832ce14c9c1970e257794b4fafa0
SH256 hash:
54167ae0968e05910ef8dcd8bbc345afe3dad810fd3c9d2d3f47ad4caffc456d
MD5 hash:
4fd5a2cd0c65c6552fea0cc11938f251
SHA1 hash:
e8f11c1f919eee06f8ebfde989ff53a15243e57f
SH256 hash:
3564ce8b510acfe456f7135e0c1ac1f71cfa39c787909192be8f8ed40dcbe305
MD5 hash:
a396d30099517546b62c0aa673929f93
SHA1 hash:
f3eea24ee7faf86638dfd8c730a544a94716378b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Detect_NSIS_Nullsoft_Installer |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects NSIS installers by .ndata section + NSIS header string |
| Rule name: | Win_Clipboard_Clipper_Thengavar |
|---|---|
| Author: | Thengavar |
| Description: | Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 5b288132f126e009d486f2125b1b7cdb126ae2fa55a96bcebaf9dcc20f0acd1e
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.