MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b07eb8c0c2ab0ff4b51617bc7eed1742ef537e70dc61629b20be3bde09d4d1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b07eb8c0c2ab0ff4b51617bc7eed1742ef537e70dc61629b20be3bde09d4d1c
SHA3-384 hash: 8b41e1ef564ab0f8d9f684a8eb98c3f220e44d0df2384982842a185baf32da4a7bdf1b2b5abf0aada433034628001a3f
SHA1 hash: f22a62250fb9bbb0d31a8632c82deee2ce1e467f
MD5 hash: f5e280984950ae31faa056ce8efa56a6
humanhash: illinois-mirror-zulu-snake
File name:9z7BGnRGpgs8cZv7.exe
Download: download sample
File size:2'993'152 bytes
First seen:2026-08-11 08:23:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f5bec796b7b3c2932293afa8281cdeed
ssdeep 49152:emuIASnAOadKiXsm5w01+VVYt1EhpBq5QckX3U7J/5twzbJWf5RgaTqryQ:lNjnJwvXW00szEbBq5Fk071gzbJo5RvA
TLSH T1B6D523987DF619B0D037C7B9CF82F0AD71297BA09BA04EAB37CD25409E226585D35378
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
SE SE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5efbd05b-5f9e-4ad2-8a17-bba339fe2b81/
Gathering data
Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6a7adc09086bfd23460e42dc/reports/ab2b3d8b-4dee-427e-9d17-fbb1aa281106/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6b07eb8c0c2ab0ff4b51617bc7eed1742ef537e70dc61629b20be3bde09d4d1c
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-08-10T11:41:00Z UTC
Last seen:
2026-08-10T17:16:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/6b07eb8c0c2ab0ff4b51617bc7eed1742ef537e70dc61629b20be3bde09d4d1c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d4fc901b-12d2-49fe-976d-5de9786b51de
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1955757
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates / moves files in alternative data streams (ADS)
Deletes itself after installation
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Suricata IDS alerts for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1955757 Sample: 9z7BGnRGpgs8cZv7.exe Startdate: 11/08/2026 Architecture: WINDOWS Score: 100 35 polygon-bor-rpc.publicnode.com 2->35 37 health.journal-metric.lol 2->37 47 Suricata IDS alerts for network traffic 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 2 other signatures 2->53 9 9z7BGnRGpgs8cZv7.exe 11 2->9         started        13 UsoClient34ed49.exe 33 2->13         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\UsoClient34ed49.exe, PE32+ 9->31 dropped 33 C:\...\UsoClient34ed49.exe:Zone.Identifier, ASCII 9->33 dropped 55 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->55 57 Creates / moves files in alternative data streams (ADS) 9->57 59 Uses schtasks.exe or at.exe to add and modify task schedules 9->59 61 Deletes itself after installation 9->61 15 UsoClient34ed49.exe 33 9->15         started        19 schtasks.exe 1 9->19         started        63 Antivirus detection for dropped file 13->63 65 Multi AV Scanner detection for dropped file 13->65 67 Found direct / indirect Syscall (likely to bypass EDR) 13->67 21 schtasks.exe 1 13->21         started        signatures6 process7 dnsIp8 39 polygon-bor-rpc.publicnode.com 104.20.24.117, 443, 49705, 49707 CLOUDFLARENET-CloudflareIncUS Canada 15->39 41 health.journal-metric.lol 104.21.0.120, 443, 49706, 49708 CLOUDFLARENET-CloudflareIncUS Canada 15->41 43 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 15->43 45 Found direct / indirect Syscall (likely to bypass EDR) 15->45 23 schtasks.exe 1 15->23         started        25 conhost.exe 19->25         started        27 conhost.exe 21->27         started        signatures9 process10 process11 29 conhost.exe 23->29         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6b07eb8c0c2ab0ff4b51617bc7eed1742ef537e70dc61629b20be3bde09d4d1c
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b07eb8c0c2ab0ff4b51617bc7eed1742ef537e70dc61629b20be3bde09d4d1c/
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-10 21:33:57 UTC
File Type:
PE+ (Exe)
AV detection:
20 of 36 (55.56%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nmd6xdamfkyp6s2rmf54p3wroqxpkn7hbxdbmknsbpr33ye5juoa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution persistence
Link:
https://tria.ge/reports/260811-kagpgaar2x/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Deletes itself
Executes dropped EXE
Unpacked files
SH256 hash:
6b07eb8c0c2ab0ff4b51617bc7eed1742ef537e70dc61629b20be3bde09d4d1c
MD5 hash:
f5e280984950ae31faa056ce8efa56a6
SHA1 hash:
f22a62250fb9bbb0d31a8632c82deee2ce1e467f
Link:
https://www.unpac.me/results/2394c9a9-5fec-487e-ac5e-e0fc690134ca/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6b07eb8c0c2ab0ff4b51617bc7eed1742ef537e70dc61629b20be3bde09d4d1c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/80247/
  
URLhaus
https://urlhaus.abuse.ch/url/3894881/
  
Delivery method
Distributed via web download

Comments