MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7299d673b54d925035aaca820db13f3daa1e39e11cda36dbbfcc7bd26ffb6fc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 10 File information Comments

SHA256 hash:	7299d673b54d925035aaca820db13f3daa1e39e11cda36dbbfcc7bd26ffb6fc9
SHA3-384 hash:	38a4c19cef9392c57bb2349da212769111fc52a36df70062f446834eac9b9b62424322a55d21163beb8ad59e270aa0fd
SHA1 hash:	da238035b33c05c2dcdcc682f973f11b51ed214c
MD5 hash:	2e69b5ad42286758de826783aea6db19
humanhash:	lactose-jersey-five-uranus
File name:	file
Download:	download sample
File size:	17'920 bytes
First seen:	2026-10-09 07:09:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	72e633ef14c8f94d9da18bed2ab93c38
ssdeep	384:lVSFNGu6Pkn7NvD/1Iyzrv/GouXrAVKudPczJj/MhYPyuJZa7gJXxIgF0:vSPGh8ZvJIaDOougySUpqgF
TLSH	T1A7829EBA72BEEABCC47696B0D9B44161FA313C276911436F18A1357E0CF7750AC11F62
TrID	63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12) 24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.8% (.ICL) Windows Icons Library (generic) (2059/9) 1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	54e64e dropped-by-amadey exe UPX

Bitsight

url: http://91.92.242.236/files-129312398/files/file_146f8720a4894bd8.exe

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	17'920 bytes
File size (de-compressed) :	31'232 bytes
Format:	win64/pe
Unpacked file:	04b400bda51ff40e3d4eaca9cd6025b4cea54ae96ee1817ac9aa528737fdd957

Intelligence

File Origin

# of uploads :

# of downloads :

211

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7feaa3ec-42b7-49f4-a88b-3a740c500779/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-09 07:13:09 UTC

Tags:

auto-reg upx ims-api generic

Link:

https://app.any.run/tasks/885e093f-3904-4d39-b24f-cb3a23c94dd6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91210/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a process with a hidden window

Deleting a recently created file

Creating a file

Launching a process

Creating a file in the %AppData% directory

Connection attempt

Sending an HTTP GET request

DNS request

Sending a custom TCP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug masquerade packed packed packed packer upx

Link:

https://www.filescan.io/uploads/6ac8935bbbb44b47d7098312/reports/7bee04bd-533a-4cfb-a288-10049c12db7c/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/7299d673b54d925035aaca820db13f3daa1e39e11cda36dbbfcc7bd26ffb6fc9

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-09T04:30:00Z UTC

Last seen:

2026-10-10T18:53:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7299d673b54d925035aaca820db13f3daa1e39e11cda36dbbfcc7bd26ffb6fc9/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/da3b1faa-8ae7-4822-89cf-2fcbfab8a4d8

Score:

92%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7299d673b54d925035aaca820db13f3daa1e39e11cda36dbbfcc7bd26ffb6fc9

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/2e69b5ad42286758de826783aea6db19

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7299d673b54d925035aaca820db13f3daa1e39e11cda36dbbfcc7bd26ffb6fc9/

Threat name:

Win64.Trojan.Sonbokli

Status:

Suspicious

First seen:

2026-10-09 07:10:12 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

15 of 38 (39.47%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=okm5m45vjwjfannkzkba3mj7hwvb4opbdtndnw57zr55e373n7eq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

defense_evasion discovery execution persistence upx

Link:

https://tria.ge/reports/261009-hzhxqacv2v/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Reads the TCP/IP host and domain name from the registry

UPX packed file

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Executes a file named after a Windows system binary

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Unpacked files

SH256 hash:

7299d673b54d925035aaca820db13f3daa1e39e11cda36dbbfcc7bd26ffb6fc9

MD5 hash:

2e69b5ad42286758de826783aea6db19

SHA1 hash:

da238035b33c05c2dcdcc682f973f11b51ed214c

Link:

https://www.unpac.me/results/9dc0437a-cc5e-4f3a-953d-e7bda44a8261/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/7299d673b54d925035aaca820db13f3daa1e39e11cda36dbbfcc7bd26ffb6fc9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (script_js, etat binaire)

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.