MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 14

Intelligence 14 IOCs YARA 35 File information Comments

SHA256 hash:	728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792
SHA3-384 hash:	0c1a1f4813b6d2438e0261e97dd0d7d59980c3cb8cf1cff8257fef739fae230966a252a8d00301e5389c65fafc77d556
SHA1 hash:	b93ce9b04ae7c536722d1bf9e80c007c67c49058
MD5 hash:	104a4f8c67f6ac569fadd6d259f7f03b
humanhash:	sierra-moon-muppet-october
File name:	file
Download:	download sample
File size:	2'106'368 bytes
First seen:	2026-04-11 23:50:05 UTC
Last seen:	2026-04-11 23:53:50 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	38c192218334865e56f906ff44fbc4b0
ssdeep	24576:s5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:gno8haujVsPAB8KY2+Bz+2
Threatray	15 similar samples on MalwareBazaar
TLSH	T19FA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543

Bitsight

url: http://85.239.147.6/files/8042875554/RvsamEB.exe

Intelligence

File Origin

# of uploads :

# of downloads :

189

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/575cd93a-14ae-415c-9b65-65a2da9fa54e/

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2026-04-11 23:51:24 UTC

Tags:

evasion auto-reg auto-startup stealer meduza donutloader loader rdp amsi-bypass ip-check

Link:

https://app.any.run/tasks/9f93ee1e-415e-4258-81cc-37f42399b5ee

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/61191/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69dade556a61012f6ad10701

Tags:

infosteal autorun emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending an HTTP GET request

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Sending a UDP request

Sending a custom TCP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm cmd control crypto cscript evasive expand explorer fingerprint hacktool installutil keylogger lolbin meterpreter microsoft_visual_cc mikey msbuild netsh obfuscated ransomware regasm runonce sc schtasks stealer tracker wmic wscript

Link:

https://www.filescan.io/uploads/69dade4e799d5bf325f83fcb/reports/61f27d50-cae6-45ac-9c0a-80281b2b7d2d/overview

Verdict:

Malicious

Labled as:

Mikey.Generic

Link:

https://www.hybrid-analysis.com/sample/728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-04-11T21:08:00Z UTC

Last seen:

2026-04-12T15:03:00Z UTC

Hits:

~100

Detections:

PDM:Trojan.Win32.Generic Trojan.Win32.Reconyc.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.Win32.Agent.sba Trojan.Win32.Agent.sb Trojan-PSW.Win32.Greedy.sb Trojan-PSW.Win32.Agent.sb Trojan-PSW.MSIL.Stealer.sb Trojan-Banker.Win32.Express.sb HEUR:Trojan.Win32.Generic HEUR:Trojan-PSW.Win64.Stealer.gen HEUR:Backdoor.Win32.Agent.gen

Link:

https://opentip.kaspersky.com/728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d1c515d3-cb87-442c-9d64-99fd8e011ead

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792

Verdict:

inconclusive

YARA:

7 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/104a4f8c67f6ac569fadd6d259f7f03b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792/

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792

Threat name:

Win64.Trojan.Cerbu

Status:

Malicious

First seen:

2026-04-11 23:51:01 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

25 of 37 (67.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=okhhlluerldcvjyf5vheyaan2pp2fjgpocs2366fnrnj2kybo6ja._file

Verdict:

malicious

Label(s):

unc_stealer_006

0563f9e1d0fe8c2cf932f55fb8341ee86c1d1ee7d1be5d99f929db36d92dcf97

1dc49390801ae4be6be1568ca9616aa9d9368b4ee5f009a15d69ec73bb453f61

5f8c68208da634266a32abc0ae86146ed0178e4f5c2253e880b4cfc6caac5f06

728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792

93b70cbf0e33621499d8d076fece24e5683003c728652711934d0bfc1902adbd

d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2

d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee

e48aae30303baaabdf26a9554bdc9da8d2215b584c14c6a787e027f48fdc610b

error

+ 5 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

persistence

Link:

https://tria.ge/reports/260411-3vw9rsdx7t/

Behaviour

Checks processor information in registry

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Adds Run key to start application

Looks up external IP address via web service

Drops startup file

Executes dropped EXE

Unpacked files

SH256 hash:

728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792

MD5 hash:

104a4f8c67f6ac569fadd6d259f7f03b

SHA1 hash:

b93ce9b04ae7c536722d1bf9e80c007c67c49058

Link:

https://www.unpac.me/results/368a8f58-0786-4dbb-a1fe-d696a18cd73d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_mod_tough_bin Create hunting rule
Author:	James_inthe_box
Reference:	https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CMD_Ping_Localhost Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	HKTL_Meterpreter_inMemory Create hunting rule
Author:	netbiosX, Florian Roth
Description:	Detects Meterpreter in-memory
Reference:	https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of MFA browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing artifacts associated with disabling Widnows Defender

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many Password Manager software clients. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_GENRansomware Create hunting rule
Author:	ditekSHen
Description:	Detects command variations typically used by ransomware

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PowerShell_Susp_Parameter_Combo_RID336F Create hunting rule
Author:	Florian Roth
Description:	Detects PowerShell invocation with suspicious parameters
Reference:	https://goo.gl/uAic1X

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	WIN_SHADOW_UNPACKED Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 728e75ae848ac62aa705ed4e4c000dd3dfa2a4cf70a5adfbc56c5a9d2b017792

(this sample)

Dropped by

Amadey

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/61191/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample