MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 610d7fdaa16d3b53cbfbb2dc000fc9410b418eb409257a3d0b3b9b2f9a93cb87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	610d7fdaa16d3b53cbfbb2dc000fc9410b418eb409257a3d0b3b9b2f9a93cb87
SHA3-384 hash:	9313f6a565b23c189bd3b72fb6531be13c09015537bf5af6f88affc486f60cb6954f78b5b61af0ab91b10baaff7736e4
SHA1 hash:	0c97af3225af4c7f9c414c0e4bdb7a857a9356e5
MD5 hash:	8a9447c40c3d31ffc263dc95276b9271
humanhash:	july-tango-bulldog-september
File name:	file
Download:	download sample
File size:	87'492'768 bytes
First seen:	2026-05-04 22:10:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	1572864:ikbtPk+9uXaRVJz9AYYfDYv+fRn+vEA5x0CwNrs0yL3Hz4javBl3I:5pc+9uXaRVJCtfk+Jn4x0CwNYTD4GvB+
TLSH	T14F1833EFABA995E0C5223FFC9CD1AE005BA67CE47490419F158AF72BDC30A038F16565
TrID	26.9% (.EXE) Win64 Executable (generic) (6522/11/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	2b7292cec6ccec92
Reporter	Bitsight
Tags:	d52f85 dropped-by-amadey exe signed

Bitsight

url: http://62.60.226.140/files/mario/random.exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

139

Origin country :

US

Vendor Threat Intelligence

ACCE

Gathering data

ANY.RUN

Malware family:

n/a

ID:

1

File name:

610d7fdaa16d3b53cbfbb2dc000fc9410b418eb409257a3d0b3b9b2f9a93cb87.bin

Verdict:

No threats detected

Analysis date:

2026-05-04 22:11:30 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7719f304-ff3e-44cb-93d8-22ff7b3dea95

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a process from a recently created file

Сreating synchronization primitives

Creating a file in the Windows subdirectories

Running batch commands

Creating a process with a hidden window

Launching a process

Creating a window

Creating a file

Enabling autorun by creating a file

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug installer-heuristic obfuscated obfuscated packed signed xor-pe

Link:

https://www.filescan.io/uploads/69f9195a7d31ad7bba4e4396/reports/5934cc93-1c60-40f5-8b01-aee9b21fed28/overview

Hybrid Analysis Kryptik.HZHD trojan

Verdict:

Malicious

Labled as:

Kryptik.HZHD trojan

Link:

https://www.hybrid-analysis.com/sample/610d7fdaa16d3b53cbfbb2dc000fc9410b418eb409257a3d0b3b9b2f9a93cb87

InQuest

Result

Gathering data

Nucleon Malprob Malware

Score:

78%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/610d7fdaa16d3b53cbfbb2dc000fc9410b418eb409257a3d0b3b9b2f9a93cb87

CERT.PL MWDB

Gathering data

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/610d7fdaa16d3b53cbfbb2dc000fc9410b418eb409257a3d0b3b9b2f9a93cb87

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=megx7wvbnu5vhs73wloaad6jiefuddvubesxupilhons7gutzodq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

adware defense_evasion discovery execution persistence spyware

Link:

https://tria.ge/reports/260504-13mzysds2t/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies Internet Explorer settings

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Checks installed software on the system

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.