🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b
SHA3-384 hash: 0408c88644dca64cc525ed1f720da3caf87288f692889ad5d63b1d84b46fe3690d0a01e24cfce99176d7d1202c03255c
SHA1 hash: 0db0df238940d0009122b6fc74286efe444bdc0e
MD5 hash: 30f59c5ec9301f8d0360df48c8357fe4
humanhash: low-diet-echo-table
File name:5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b.bin
Download: download sample
File size:2'295'255 bytes
First seen:2026-09-30 07:14:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:xOD2CqkDBDgqfkzPF85Lck96YTURXWAuL022sptjLCms9UqBYjlR0t9+T9919eCJ:sCEDBxkN85Lck9JTAXU+gWuqolWX+z1j
TLSH T148B533A71C410517D8E61838A96ECFBD34BCC6620321D1881858F1A5EF94FA8FDEF5A9
Magika zip
Reporter whack_sh
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
US US
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Trololo.exe
File size:3'136'512 bytes
SHA256 hash: 3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe
MD5 hash: b6d61b516d41e209b207b41d91e3b90d
MIME type:application/x-dosexec
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f6c892ab-2075-4ca8-a6d6-3d0125cac1c9/
Detection(s):
Win.Trojan.MSIL-31
Create hunting rule

Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
explorer lolbin packed vbnet
Link:
https://www.filescan.io/uploads/6abcb70fbf3cb816c76c256f/reports/d1119644-8094-4393-991b-820835e896f1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b
Verdict:
Malicious
File Type:
zip
First seen:
2024-04-02T10:09:00Z UTC
Last seen:
2024-04-02T15:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b/results?tab=lookup
Score:
81%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.21 Zip Archive
Link:
https://app.malva.re/file/30f59c5ec9301f8d0360df48c8357fe4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b/
Threat name:
ByteCode-MSIL.PUA.Trololol
Create hunting rule
Status:
Malicious
First seen:
2024-04-02 15:21:39 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
29 of 36 (80.56%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lqhkymyjsg6jpppniaq5ouiaqrwsaa54tipjjw2lc5hk4uw4qfvq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion
Link:
https://tria.ge/reports/260930-m9b95sdg46/
Behaviour
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Disables Task Manager via registry modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 5c0eac330991bc97bded4021d75100846d2003bc9a1e94db4b174eae52dc816b

(this sample)

  
Delivery method
Distributed via web download

Comments