MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62b5b13e0fc9f32094a64588e1858f8d02cb72cbf007a4dfbc6d405bc34a94de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Prometei

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	62b5b13e0fc9f32094a64588e1858f8d02cb72cbf007a4dfbc6d405bc34a94de
SHA3-384 hash:	91958a9d13638bd86568595b12e510c883d61e39ca705493613a84ed3366d68f5923916df1eac8645fa02f2c1289cc75
SHA1 hash:	691d883d604bf2f4b4982cf0300a4ee0a6d159d6
MD5 hash:	81173504f80c3668bc5edc605ec61f49
humanhash:	fourteen-network-yankee-arkansas
File name:	d663e8d385168a53730dc4620dd85f7dae2076fd8ae79b07a80be03fecfe6682
Download:	download sample
Signature	Prometei Create hunting rule
File size:	348'166 bytes
First seen:	2026-09-15 06:20:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d9210cd966b2e5956644b71b6805e8d7 (5 x Prometei)
ssdeep	6144:Q+LQwhNI65MY5wH2l3D5YolYvRjf6yl/5JTFw1iKzHk2oGbksEb5iFef:QMQwA65YHWDeXvRjf6YnyixGbk1oq
TLSH	T1B574DF63B6B8F14EE88297324B57CB0287A53FA58892D09E79B4230F2C756544F74F72
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Prometei upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 d663e8d385168a53730dc4620dd85f7dae2076fd8ae79b07a80be03fecfe6682

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	252'422 bytes
File size (de-compressed) :	348'166 bytes
Format:	win32/pe
Packed file:	d663e8d385168a53730dc4620dd85f7dae2076fd8ae79b07a80be03fecfe6682

Intelligence

File Origin

# of uploads :

# of downloads :

162

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-15 07:47:14 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5d29a8c9-98dd-4fa1-9852-7d606abed137

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/85527/

Detection(s):

Win.Malware.Tgqv7oji-9939403-0

ditekSHen.MALWARE.Win.Ransomware.Avaddon.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm cmd crypto evasive fingerprint lolbin microsoft_visual_cc netsh overlay packed

Link:

https://www.filescan.io/uploads/6aa8e3d4dc0329f10a1f1c65/reports/5c182409-e070-476f-a5d6-af517606ee1f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/62b5b13e0fc9f32094a64588e1858f8d02cb72cbf007a4dfbc6d405bc34a94de

Malware family:

Prometei

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b37607e0-7e68-4902-8e67-3b4012c34994

Result

Threat name:

Prometei

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1973005

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses ping.exe to check the status of other devices and networks

Writes or reads registry keys via WMI

Yara detected Prometei

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/62b5b13e0fc9f32094a64588e1858f8d02cb72cbf007a4dfbc6d405bc34a94de

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/81173504f80c3668bc5edc605ec61f49

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/62b5b13e0fc9f32094a64588e1858f8d02cb72cbf007a4dfbc6d405bc34a94de/

Threat name:

Win32.Malware.Heuristic

Status:

Malicious

First seen:

2026-09-15 06:21:22 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 36 (86.11%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mk23cpqpzhzsbffgiweodbmprubmw4wl6ad2jx54nvafxq2kstpa._file

Verdict:

malicious

Label(s):

cannoLoader

Link:

https://reports.threatray.com/97e51293-400d-41b5-9ba8-366fc41b46d8

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260915-g4f39aselb/

Behaviour

Gathers system information

Runs ping.exe

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Checks computer location settings

Unpacked files

SH256 hash:

62b5b13e0fc9f32094a64588e1858f8d02cb72cbf007a4dfbc6d405bc34a94de

MD5 hash:

81173504f80c3668bc5edc605ec61f49

SHA1 hash:

691d883d604bf2f4b4982cf0300a4ee0a6d159d6

Link:

https://www.unpac.me/results/7e423c1c-9f0a-48bd-b95e-e5380dcadc52/

SH256 hash:

df05fae746de3d3fbee6a184bb6e3800e15cf71ed2412371a1fbeb990d35502c

MD5 hash:

e14318b611a929bca65898fd5dc1957e

SHA1 hash:

c8ede070d84a90cc7e112b0b9732c787d660a069

Link:

https://www.unpac.me/results/7e423c1c-9f0a-48bd-b95e-e5380dcadc52/

Malware family:

Prometei

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/62b5b13e0fc9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.