MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8
SHA3-384 hash: 280f559b4996c7459e72a609721a2b6411a6d3035cdfe2516b66889b8c80efb4ee3dc879408c51999be2be1f95f6eafb
SHA1 hash: 7f4bb7e323d9f19e729f430aa67ba0678cc56cf5
MD5 hash: 8d46f7d3a2c0bb97c766ffd17e583df3
humanhash: angel-colorado-mobile-louisiana
File name:5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8
Download: download sample
File size:378'368 bytes
First seen:2026-06-18 06:25:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 1536:AT8jx2MmORavgXOHithDeIUVQsS3miXXSBpiFOIgVejPzAx06c0MCAj/lcmuN7m/:aex2Qw4veQsQi/iFuedlmlAZxP
Threatray 268 similar samples on MalwareBazaar
TLSH T15B84238B97164203EACF023884B39AB5A3B0D0155EB1E60ED9FA50F76E707DD2985379
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter JAMESWT_WT
Tags:2-27-62-123 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8.exe
Verdict:
No threats detected
Analysis date:
2026-06-18 06:26:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8c6782e8-5e4e-4058-82fa-3115648ea6b8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/71128/
Detection(s):
SecuriteInfo.com.Variant.Barys.511724.92783394.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a338fa854a045c3408a1799
Tags:
downloader shellcode dropper
Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Connection attempt to an infection source
DNS request
Connection attempt
Sending an HTTP GET request
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/6a338fa09799578a6c3f106e/reports/9791289a-af90-484e-bd04-b5ec0d3f4956/overview
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-06-08T07:53:00Z UTC
Last seen:
2026-06-20T00:50:00Z UTC
Hits:
~10
Detections:
Trojan.MSIL.Agent.sb HEUR:Trojan.MSIL.Agent.gen HEUR:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/13b48840-8e34-471c-8474-4885a95dc5cd
Score:
23%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8/
Verdict:
Malicious
Threat:
Trojan.MSIL.Agent
Link:
https://tip.neiki.dev/file/5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8
Threat name:
ByteCode-MSIL.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2026-06-08 12:54:24 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
1
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2fmabgfjdth44dpokj3kvdrit4nm3enhdzi6bn5d73mm5tidhua._file
Verdict:
malicious
Label(s):
stubrunner
Create hunting rule
Similar samples:
03b9d024bbfa55f9e7dd65afab96792effe79f17b1b642b4b88ddeb07a824339
075719f16c7819c54136040c9c75810dc564b48c7e517d2eaafe059d8c20ef26
26b40edcb6058e198db20eeeb6c02cb4a0d54c89bce38361f1ea7bedc4e60ebc
6a2190283ef6a15821480ae235d4fc21a526d10b9a167741e5640d433aee15d1
8765a68285521845c3c82b3ed49cd5fcec5fa099f557dd735f231c9f2c7af410
a3669947bc7cac83115f64e7b1c1a3a1921ac778926aebfb2570a1f0105b70d1
b30d1d996a7dc840ac03ab4e97e5e02c444ec892333bdffe8e4901c4f026d485
bc5c060f306d5218716dfdc6ded8091d5f5306b91c63cc0cdf760b41a99108c9
df6f087bbe332de8def4d842f8c22a4cd48d46e735e31d84e9485595fa5ccd7f
df915ff4a85619f377c321e2a2cfd3d53051380b971441f117ddf16c8786a022
error
+ 258 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/260618-g7jcsafw3p/
Behaviour
Suspicious use of AdjustPrivilegeToken
Checks computer location settings
Unpacked files
SH256 hash:
5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8
MD5 hash:
8d46f7d3a2c0bb97c766ffd17e583df3
SHA1 hash:
7f4bb7e323d9f19e729f430aa67ba0678cc56cf5
Link:
https://www.unpac.me/results/cd6162b4-d3a4-4d59-a426-5e583dd5277b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e8ac004c548e67e706f7293b5547144f8d66c8d38f28f05bd1ff6c6766819e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/71128/

Comments