MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d
SHA3-384 hash: f476fd3d725e7d92b60c8e5b35dc683628f4e0e79131ee49c02ef149a0da9b0e88dc57f76ed9d0c66c54e5e507f4ca48
SHA1 hash: d094fba06ede63de45471f6ae656716e8c0f9571
MD5 hash: ebe2d34a9c65ebf5fe11a588b35ab07b
humanhash: angel-wyoming-charlie-kilo
File name:5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d
Download: download sample
File size:5'632 bytes
First seen:2026-04-23 09:04:32 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 61 x CobaltStrike, 44 x JanelaRAT)
ssdeep 48:6NpcrzSjsj84XdCXVZPmXBkrZRJrLHNr9oQmkugzNCCYShXwiyaaZlqglSto4TmK:Vmjsj84iHm+Ffmk5Xwj7S301GGK
TLSH T192C1A122D7D90926E8BF4B3CACE21B8253B4B44C0BB20B6B1DD851076C974946933BF1
TrID 23.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
23.4% (.EXE) Win64 Executable (generic) (6522/11/2)
16.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.4% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter JAMESWT_WT
Tags:dll Google-Gemini

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/63275/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69e9e0c151cce3ff702f5474
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d
Verdict:
Clean
File Type:
executable.pe.32.dll
Link:
https://opentip.kaspersky.com/5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9a91729f-ebd2-45d0-a8f2-0514bb3c224d
Score:
56%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-04-18 20:39:29 UTC
File Type:
PE (.Net Dll)
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lrvcy47vt7mn567rdd4h4xeixjrogbt7r2ga5uie6pyyr6qnswoq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260423-k12gkafy7x/
Unpacked files
SH256 hash:
5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d
MD5 hash:
ebe2d34a9c65ebf5fe11a588b35ab07b
SHA1 hash:
d094fba06ede63de45471f6ae656716e8c0f9571
Link:
https://www.unpac.me/results/28d1460f-7f77-4c61-a303-f180cc3c7398/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/63275/

Comments