MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 686492d6fdc77d25ac4965be3fcc2cf0bb51bfdb41cc52f500aa45f542fe6660. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	686492d6fdc77d25ac4965be3fcc2cf0bb51bfdb41cc52f500aa45f542fe6660
SHA3-384 hash:	bc96dbf1fd9e92a31342e94a63feb1c1daf7ca1442fa0068ab5923c073193a9f48f0d3e3359db30b913491241c4e3a5d
SHA1 hash:	143954c1c063d8c33dbd8d4e6805f61bb04d9fcf
MD5 hash:	9a2ab99004876abd33ee019280487079
humanhash:	colorado-bakerloo-one-nuts
File name:	SecuriteInfo.com.Win64.Evo-gen.56248671
Download:	download sample
File size:	2'928'640 bytes
First seen:	2026-07-22 08:42:54 UTC
Last seen:	2026-07-22 11:19:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f5bec796b7b3c2932293afa8281cdeed
ssdeep	49152:DznVb6S7gHmckYaZdmU6QyXbwtiByYljbaz4Vnt90Yi5yHP6X3CqlhzNkwQgUNRW:HnV2S7gGckfqhPbwtkywazqVHU/lhRkm
TLSH	T117D5238638F12AB4C47BC7B29F43E92EB06A77454AB48E1BBACC69014E531487D37375
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

---

File Origin

# of uploads :

6

# of downloads :

161

Origin country :

FR

Vendor Threat Intelligence

ACCE VMProtect_Packer_PE

Details

Link:

https://research.acce.ciphertechsolutions.com/results/221de07a-c266-4d6a-b46a-a3869c791a4b/

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/75654/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.56248671.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a6082b05da3c5ff37fd195e/reports/cac186c4-605e-4369-91da-42694dc0f2a9/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/686492d6fdc77d25ac4965be3fcc2cf0bb51bfdb41cc52f500aa45f542fe6660

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7dda1d5a-cfcb-4b8e-b99c-eff53e7d1e01

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/686492d6fdc77d25ac4965be3fcc2cf0bb51bfdb41cc52f500aa45f542fe6660

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/9a2ab99004876abd33ee019280487079

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/686492d6fdc77d25ac4965be3fcc2cf0bb51bfdb41cc52f500aa45f542fe6660/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nbsjfvx5y56sllcjmw7d7tbm6c5vdp63ihgff5iavjc7kqx6mzqa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260722-kmwddscg36/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Deletes itself

Executes dropped EXE

UnpacMe

Unpacked files

SH256 hash:

686492d6fdc77d25ac4965be3fcc2cf0bb51bfdb41cc52f500aa45f542fe6660

MD5 hash:

9a2ab99004876abd33ee019280487079

SHA1 hash:

143954c1c063d8c33dbd8d4e6805f61bb04d9fcf

Link:

https://www.unpac.me/results/fcb7c1e8-64dc-4b9d-9979-8993c024c584/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/686492d6fdc77d25ac4965be3fcc2cf0bb51bfdb41cc52f500aa45f542fe6660

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 686492d6fdc77d25ac4965be3fcc2cf0bb51bfdb41cc52f500aa45f542fe6660

(this sample)

Cape

https://www.capesandbox.com/analysis/75654/

  

URLhaus

https://urlhaus.abuse.ch/url/3889915/

  

Delivery method

Distributed via web download