MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5d4db2e3cac1da48ae87df7ab46f6a9b527922b4785da87851314d16a77d9e08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
PureCrypter
Vendor detections: 14
| SHA256 hash: | 5d4db2e3cac1da48ae87df7ab46f6a9b527922b4785da87851314d16a77d9e08 |
|---|---|
| SHA3-384 hash: | 5bd478165b9cf6914d93c4b601e48e6f93d38c8e0bcff0f32aee7a3bf975f808b6fcea1730671b4515ad69c4d4ef9133 |
| SHA1 hash: | 0a38389f82abc696a1e6b0fd86994104db36e383 |
| MD5 hash: | 0c29e650d99e0aa6e3ec2f1b025eb9e6 |
| humanhash: | table-oranges-fix-lemon |
| File name: | HMC.exe |
| Download: | download sample |
| Signature | PureCrypter |
| File size: | 3'270'144 bytes |
| First seen: | 2026-03-15 06:17:15 UTC |
| Last seen: | 2026-03-15 07:42:18 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'696 x Formbook, 12'401 x SnakeKeylogger) |
| ssdeep | 24576:KlTVsQ6BKfC+CWDU2fy6Uuri8MmOmbCYUz7PH8Zeaj0HM3ow5XtgvcbvsULsh:ETVeBB2kMOnYUvPbBkn |
| TLSH | T17AE52813B3154F69F0C686B7B5A8EF3406F0E709B56BA633BCB46E653542220DC4B978 |
| TrID | 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | 71ccccc8c4cccc71 (1 x PureCrypter) |
| Reporter |  Skynet11 |
| Tags: | exe Jalapeno purecrypter |
Intelligence
File Origin
# of uploads :
2
# of downloads :
169
Origin country :
AUVendor Threat Intelligence
Malware configuration found for:
ConfuserEx
NETReactor
RoboSki
Details
NETReactor
decrypted strings
Malware family:
n/a
ID:
1
File name:
HMC.exe
Verdict:
Malicious activity
Analysis date:
2024-04-16 18:37:49 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
96.5%
Tags:
packed virus
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm base64 confuserex confuserex crypt explorer fingerprint lolbin obfuscated obfuscated overlay packed packed soft-404 unsafe vbnet
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-01-27T09:34:00Z UTC
Last seen:
2024-10-27T14:22:00Z UTC
Hits:
~100
Detections:
Backdoor.RRAT.HTTP.C&C Backdoor.Bladabindi.TCP.C&C Trojan.Win32.Agent.sb Trojan.MSIL.Crypt.sb VHO:Backdoor.MSIL.Agent.gen Backdoor.MSIL.Agent.sb Backdoor.SpyGate.TCP.C&C HEUR:Backdoor.MSIL.Revenge.gen BSS:Trojan.Win32.Generic Trojan.Revenge.TCP.C&C Trojan.Agent.TCP.C&C Backdoor.Agent.TCP.C&C HEUR:Trojan.MSIL.Agent.gen Trojan.Win32.RRAT.sb PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.RRAT.gen
Malware family:
Revenge Ransomware
Verdict:
Malicious
Score:
73%
Verdict:
Malware
File Type:
PE
Gathering data
Verdict:
Malicious
Threat:
Trojan.RRAT.RRAT
Threat name:
ByteCode-MSIL.Trojan.Jalapeno
Status:
Malicious
First seen:
2024-01-27 19:14:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
127
AV detection:
26 of 36 (72.22%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
10/10
Tags:
defense_evasion discovery persistence privilege_escalation trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Checks computer location settings
Executes dropped EXE
Modifies Windows Firewall
Contains code to disable Windows Defender
Unpacked files
SH256 hash:
5d4db2e3cac1da48ae87df7ab46f6a9b527922b4785da87851314d16a77d9e08
MD5 hash:
0c29e650d99e0aa6e3ec2f1b025eb9e6
SHA1 hash:
0a38389f82abc696a1e6b0fd86994104db36e383
SH256 hash:
2e8931e43c5674bc641651868ef311e2d3407e0132325c0795bdf4f5404fb30f
MD5 hash:
0bd541037d1794d63bb58654f1e897c5
SHA1 hash:
a901fc2bc1fcc672b6dfee0d3e93b4ca8f11c710
Detections:
INDICATOR_EXE_Packed_ConfuserEx
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SH256 hash:
2a95104de0f1dd12579c1068d0a789721f7655de59f84ed431f006b8bbe2d2a3
MD5 hash:
914ec5019485543bb2ec8edcacd662a7
SHA1 hash:
2b0e0a2513383701690a22e7aebeaba44b2343cc
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
9cb018a17bdf9cd70f7c16f31bcb3eaa5183eb3c2a26d6c59d5c65d3438cac75
MD5 hash:
1242c41211464efab297bfa6c374223e
SHA1 hash:
42d15b2d2f4b436e8064cb56639269934f7e2c5c
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | Detect_PowerShell_Obfuscation |
|---|---|
| Author: | daniyyell |
| Description: | Detects obfuscated PowerShell commands commonly used in malicious scripts. |
| Rule name: | DotNet_Reactor |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on. |
| Rule name: | grakate_stealer_nov_2021 |
|---|
| Rule name: | INDICATOR_EXE_Packed_ConfuserEx |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with ConfuserEx Mod |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | PureCrypter |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies PureCrypter, .NET loader and obfuscator. |
| Reference: | https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Suspicious_Process |
|---|---|
| Author: | Security Research Team |
| Description: | Suspicious process creation |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | telebot_framework |
|---|---|
| Author: | vietdx.mb |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.