MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e39f5bde1dbba4d1c2a3541e1ebf3dc44a89d1980d98fb4f7b0ab023744c1ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e39f5bde1dbba4d1c2a3541e1ebf3dc44a89d1980d98fb4f7b0ab023744c1ef
SHA3-384 hash: 97aba7d154cfdaaf4d3ad44f13d57cb67f6be3a8c0ee7bd3d2a4bca1a55da452caf0420c2947063dac59cd627fcc7abc
SHA1 hash: 9f0eb4c324319bdee9ca48db31a20fcd4b40e4fe
MD5 hash: f76c7ef5a4192bb83b4ddbde3887f069
humanhash: twelve-island-artist-princess
File name:2.exe
Download: download sample
File size:328'704 bytes
First seen:2025-10-16 07:16:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b66a7e0705ba9e2ce228d17c4530f618
ssdeep 6144:mCbBmlbbDqo0vebuAR64rLCoLJH6WTog75YQ2GuWs8Okt+kCD4R9EVSOMk:dklbbFQeiw64rLnaWTog75S3WsjkokCw
TLSH T1CB6423F7CD19A289D34A023B63731DBA487344A0CAA068269C57DF7F25B66C0E9D70D3
TrID 33.6% (.EXE) OS/2 Executable (generic) (2029/13)
33.1% (.EXE) Generic Win/DOS Executable (2002/3)
33.1% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
_9764339a29c943e8b2bd9dc4ada6fd00ecff3768580d5a1610c5333e94c8d306.exe
Verdict:
Malicious activity
Analysis date:
2025-10-16 04:14:19 UTC
Tags:
loader anti-evasion crypto-regex auto-sch stealc stealer amadey botnet python rhadamanthys rdp
Link:
https://app.any.run/tasks/4b743fe5-80c3-4819-b229-fe722c16ccca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/33018/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f09bea97a16d00a8da76c6
Tags:
spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug obfuscated packed packed packed packer_detected upx
Link:
https://www.filescan.io/uploads/68f09c53057c46a471cecfad/reports/2c6a1f9e-ff6d-40f2-a5e7-67bb87c3a3c3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5e39f5bde1dbba4d1c2a3541e1ebf3dc44a89d1980d98fb4f7b0ab023744c1ef
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-10-15T20:41:00Z UTC
Last seen:
2025-10-17T22:20:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/5e39f5bde1dbba4d1c2a3541e1ebf3dc44a89d1980d98fb4f7b0ab023744c1ef/results?tab=lookup
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3f755af9-9b44-405a-9457-0221bb12eb5d
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1796310
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5e39f5bde1dbba4d1c2a3541e1ebf3dc44a89d1980d98fb4f7b0ab023744c1ef
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/f76c7ef5a4192bb83b4ddbde3887f069
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e39f5bde1dbba4d1c2a3541e1ebf3dc44a89d1980d98fb4f7b0ab023744c1ef/
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-10-16 01:28:10 UTC
File Type:
PE+ (Exe)
Extracted files:
5
AV detection:
27 of 37 (72.97%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ly47lppb3o5e2hbkgva6d27t3rckrhizqdmy7nhxwcvqen2eyhxq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
upx
Link:
https://tria.ge/reports/251016-h46jkstpx3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
UPX packed file
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8acb6e0c-46ba-4bd3-b9d3-61630da1fe26
Unpacked files
SH256 hash:
5e39f5bde1dbba4d1c2a3541e1ebf3dc44a89d1980d98fb4f7b0ab023744c1ef
MD5 hash:
f76c7ef5a4192bb83b4ddbde3887f069
SHA1 hash:
9f0eb4c324319bdee9ca48db31a20fcd4b40e4fe
Link:
https://www.unpac.me/results/6162c149-cc0a-450d-baa1-0089447f9ad6/
SH256 hash:
a6cc94d15b5f89f90dc14d2e37f8257224f8644854e4e4839c619bb605cc30bd
MD5 hash:
a43d2bab1e89d7593fd60d3992e5ae28
SHA1 hash:
d0c9f4700a37c83d496ed959c703cb63da790023
Link:
https://www.unpac.me/results/6162c149-cc0a-450d-baa1-0089447f9ad6/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5e39f5bde1db/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/5e39f5bde1dbba4d1c2a3541e1ebf3dc44a89d1980d98fb4f7b0ab023744c1ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 5e39f5bde1dbba4d1c2a3541e1ebf3dc44a89d1980d98fb4f7b0ab023744c1ef

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3590323/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3600162/
Cape
Cape
https://www.capesandbox.com/analysis/33018/

Comments