MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72068aa7d1e8eeff0411bbff29cf19a0a60ac9bd493bfaffed2e021a6bd61e33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments

SHA256 hash:	72068aa7d1e8eeff0411bbff29cf19a0a60ac9bd493bfaffed2e021a6bd61e33
SHA3-384 hash:	3fff40f8b1bf7930b55275ba1657d8fc9eada834e1dd8c5419b8aebcdf6daf40bd4bde59a2b554ce5bc1117aca047636
SHA1 hash:	2c9ceaa41b8c44c75153a11f794398508ef51a63
MD5 hash:	dd0f2b538e2ee1cbf31528f2c1d3ee98
humanhash:	kilo-autumn-pip-football
File name:	jli.dll
Download:	download sample
File size:	436'736 bytes
First seen:	2026-11-12 23:49:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	09324d3b674aebe954267c3e69f82d2c (3 x WARDENStealer)
ssdeep	6144:zbQSgv4LYEa3x41WoOUe2kDhqMxd7yjE0Fe8q49DJClxFSsmWxFuDah:zbQSkkqqcUkDQMH7ywcq4nClOnWxFCQ
TLSH	T1099423D907B890BFF417A3F849B3527C75176C126CA60B0A2AB37B5114B7B7234A5E70
TrID	33.6% (.EXE) OS/2 Executable (generic) (2029/13) 33.1% (.EXE) Generic Win/DOS Executable (2002/3) 33.1% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	AmadeyHunter
Tags:	exe stealer UPX Warden WARDENStealer

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	436'736 bytes
File size (de-compressed) :	722'432 bytes
Format:	win64/pe
Unpacked file:	ab62d780ab19ff510395173aba08afdae9da4bd354188f23107ed741841bf27e

Intelligence

File Origin

# of uploads :

# of downloads :

140

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/722a23d8-b8ba-42b7-9cab-6b2f5ea51a07/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-13 00:04:07 UTC

Tags:

upx

Link:

https://app.any.run/tasks/71871f52-661a-463f-a8bb-84d9d182cc76

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99683/

Gathering data

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af650b70a71acf937da516d

Tags:

injection cobalt shell sage

Result

Verdict:

Clean

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug masquerade packed packed packer reconnaissance upx

Link:

https://www.filescan.io/uploads/6af65078ba23d1e52550bdd8/reports/a3a50941-9b44-4f56-8ab3-49642d0cff38/overview

Verdict:

Malicious

Labled as:

Yogi.Generic

Link:

https://www.hybrid-analysis.com/sample/72068aa7d1e8eeff0411bbff29cf19a0a60ac9bd493bfaffed2e021a6bd61e33

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/2d5ff102-95ff-4a72-8bef-5606a74a6eb4

Gathering data

Score:

86%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/72068aa7d1e8eeff0411bbff29cf19a0a60ac9bd493bfaffed2e021a6bd61e33

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout UPX Win 64 Exe x64

Link:

https://app.malva.re/file/dd0f2b538e2ee1cbf31528f2c1d3ee98

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/72068aa7d1e8eeff0411bbff29cf19a0a60ac9bd493bfaffed2e021a6bd61e33/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oidivj6r5dxp6barxp7sttyzuctavsn5je57v77nfybbu26wdyzq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery upx

Link:

https://tria.ge/reports/261112-3t4x8ady5j/

Behaviour

Reads the TCP/IP host and domain name from the registry

UPX packed file

Checks installed software on the system

Badlisted process makes network request

Malware Family:

n/a

Verdict:

Suspicious

Tags:

n/a

YARA:

SUSP_Export_Offset_Undefined

Link:

https://app.threat.zone/submission/970af051-ed6c-4dbc-b68a-6c5e3b07c68d

Malware Family:

yogi

Malicious:

True

Tags:

upx 64bit file-corrupted dll

Link:

https://intel.virussign.com/intelligence/file/72068aa7d1e8eeff0411bbff29cf19a0a60ac9bd493bfaffed2e021a6bd61e33

Unpacked files

SH256 hash:

72068aa7d1e8eeff0411bbff29cf19a0a60ac9bd493bfaffed2e021a6bd61e33

MD5 hash:

dd0f2b538e2ee1cbf31528f2c1d3ee98

SHA1 hash:

2c9ceaa41b8c44c75153a11f794398508ef51a63

Link:

https://www.unpac.me/results/bdec8a47-241f-4c1a-8d3e-cbe94f9144c1/

SH256 hash:

ab62d780ab19ff510395173aba08afdae9da4bd354188f23107ed741841bf27e

MD5 hash:

9b0afdcc25f4140f2a1ac6685f6c6e03

SHA1 hash:

a1e2bc0c4c86ff31355d9d9b5b4af65619923250

Link:

https://www.unpac.me/results/bdec8a47-241f-4c1a-8d3e-cbe94f9144c1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/72068aa7d1e8eeff0411bbff29cf19a0a60ac9bd493bfaffed2e021a6bd61e33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.