MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23
SHA3-384 hash:	dcd5b80893446dcff551ad8efa750af5e65ff042da2df0868eccf153870168a0394f7acf0966f6bb2e71443b2fa06684
SHA1 hash:	e6092d9708133392751924f7a4426139aa3f2b4b
MD5 hash:	f3f22da313ded515f289cdd91c59c492
humanhash:	hamper-steak-hamper-oscar
File name:	SyMesh.exe
Download:	download sample
File size:	925'808 bytes
First seen:	2026-11-03 09:55:52 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	69aca1f52946c9ffa478a793e96c66ab
ssdeep	12288:wj29DfCcp57hjM5g4KcgC994kwNJRCJHL8Zmyv6CCIil29BVd27X:wU/7hjM5g4KcgC9SCJHL8A+DH9BV07X
TLSH	T186151AC1A862D296D67A8CFAE112FE6751BA7F91D0C0C2F775D43C3B7A0BB860362511
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	a062ba9ab8b1b185
Reporter	0xb0mb3r
Tags:	ChasysDrawIES exe signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

210

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN dcrat

Malware family:

dcrat

Alert

Create hunting rule

ID:

1

File name:

CIRCULAR FORMAL SOBRE REPORTE DE VIGILANCIA VIAL Y EVIDENCIA DIGITAL.msg

Verdict:

Malicious activity

Analysis date:

2025-10-10 17:45:33 UTC

Tags:

susp-attachments attachments attc-unc auto generic hijackloader loader dcrat rat amsi-bypass

Link:

https://app.any.run/tasks/b24b37cc-76f3-4d20-9247-9475286932d0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/96950/

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae9afbf3970fcef1e4ace65

Tags:

n/a

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm evasive microsoft_visual_cc reconnaissance signed

Link:

https://www.filescan.io/uploads/6ae9afbd68918bc0e3b309d5/reports/5c62fcef-c195-44a3-bef7-d5221f1496e9/overview

Hybrid Analysis Malware

Verdict:

Suspicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x32

First seen:

2025-02-02T23:54:00Z UTC

Last seen:

2026-11-04T23:24:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/89f6701a-37be-4ca5-a731-06512e1cc96d

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

27 / 100

Link:

https://www.joesandbox.com/analysis/1997276

Signature

Uses Windows timers to delay execution

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

10%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/f3f22da313ded515f289cdd91c59c492

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=npjoz6ou6jw37mq6zqzxcxh2kbmftp3s4ieeqnqzg6f6czsv7qrq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/261103-lyfbzst19m/

Behaviour

System Location Discovery: System Language Discovery

Threat.Zone Benign

Malware Family:

n/a

Verdict:

Benign

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/367cea7f-da67-48f4-8363-39f648a123a6

UnpacMe

Unpacked files

SH256 hash:

6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23

MD5 hash:

f3f22da313ded515f289cdd91c59c492

SHA1 hash:

e6092d9708133392751924f7a4426139aa3f2b4b

Link:

https://www.unpac.me/results/1428400b-ec1b-4f91-9d81-f465b0d7d0c2/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/96950/