MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments

SHA256 hash:	74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be
SHA3-384 hash:	13a24b78ecea2cf4366d47d21673b62ca6e52e6fc58ba02f7f5ea90f7ed69ed940aad8e37804d2576a1830b0ae262b98
SHA1 hash:	97ec4968348a344f1edcfb7e7ccb3d3ee320b7c5
MD5 hash:	5dab3694fa4709720c988b386061450c
humanhash:	kansas-zulu-wyoming-leopard
File name:	Setup.exe
Download:	download sample
File size:	1'131'008 bytes
First seen:	2025-12-08 19:35:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'474 x RedLineStealer, 4'855 x Amadey, 290 x Smoke Loader)
ssdeep	24576:QybZIxlrNFAYDhHngB9cHHSza+elM6VAS:Xd8BaYtHPyzhS
TLSH	T1E235231263E500B2ECB913B00CF30B432E76FEB15E7D569A0656666D0DB3640667A3BF
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10522/11/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
dhash icon	f0f0ccececf86970
Reporter	user35335
Tags:	exe lumma

Intelligence

File Origin

# of uploads :

# of downloads :

194

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Details

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Launching a process

Creating a process with a hidden window

Sending a custom TCP request

Running batch commands

Launching cmd.exe command interpreter

Creating a process from a recently created file

DNS request

Connection attempt

Forced shutdown of a browser

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context autoit CAB expand explorer installer installer installer-heuristic lolbin lolbin makecab microsoft_visual_cc packed rundll32 runonce sfx

Link:

https://www.filescan.io/uploads/69372878bba50eaf0427a613/reports/905a6805-b0ae-4135-b367-7ff6e9ad2cb5/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-12-08T15:01:00Z UTC

Last seen:

2025-12-10T16:06:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.Autoit.sb UDS:DangerousObject.Multi.Generic Trojan.Win32.Autoit.acyga BSS:Trojan.Win32.Generic Backdoor.Agent.UDP.C&C

Link:

https://opentip.kaspersky.com/74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/3a523417-df66-40c3-b92c-2cf2be308fa8

Score:

94%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

AutoIt CAB:COMPRESSION:LZX Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/5dab3694fa4709720c988b386061450c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be/

Verdict:

Malicious

Threat:

Family.LUMMA

Link:

https://tip.neiki.dev/file/74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=otfj37enavhxote3sfxkvijy4syg7jvsvj552pk54vxetzs24w7a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery persistence spyware stealer

Link:

https://tria.ge/reports/251208-yatkxsgm4z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/44561e0a-409b-45da-be1a-a3c25b298e8f

Unpacked files

SH256 hash:

74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be

MD5 hash:

5dab3694fa4709720c988b386061450c

SHA1 hash:

97ec4968348a344f1edcfb7e7ccb3d3ee320b7c5

Link:

https://www.unpac.me/results/3cf4cd2c-0805-40c8-89e7-6e4c24ba88d4/

SH256 hash:

b1c18d0a2079e04a846458e47737eb6543291c5e55b51d0c79f939f669f63b08

MD5 hash:

7ab2f661b7cae01f510b8ba9acfd9923

SHA1 hash:

f36d2ef6fb972bf533a2942642ae63e0253a927c

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/3cf4cd2c-0805-40c8-89e7-6e4c24ba88d4/

Parent samples :

74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be
82d8b986e2f7d6c4a69341087a88d200dc860365f038d166e8c4ea79568bc267

Malware family:

CypherIt

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/74ca9dfc8d05/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/74ca9dfc8d054f774c9b916eaaa138e4b06fa6b2aa7bdd3d5de56e49e65ae5be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.