MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1
SHA3-384 hash:	a9f07e3ce4c40f136d18905ea76463eee880949f4a026022306a41a19c386f7aa64454ea976cb1967c902bd904227564
SHA1 hash:	e7be100d8b31f8b0c42a06c44abf8b595d0b123b
MD5 hash:	04933ea6ce91169b03d5a1dc28ac9959
humanhash:	kentucky-stairway-carbon-tennessee
File name:	77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1.exe
Download:	download sample
File size:	2'958'848 bytes
First seen:	2026-08-16 02:24:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	44140cbbe125df54636c585913f74c75
ssdeep	49152:e+ZFWoOWdKpuOFY3E80rIcAvH6b6Egq4MV9D8TispzRnno62PedI3BPn1swkq337:eIFWo9iE0rIcAf6GEL4W+PpVo6M/FBSX
TLSH	T1D0D5238935BE29BAD437C3729FC5E46EB0193BC0C7754E9B3A8C79109D126906C3A379
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	whack_sh
Tags:	exe whack.sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

177

Origin country :

US

Vendor Threat Intelligence

ACCE VMProtect_Packer_PE

Details

Link:

https://research.acce.ciphertechsolutions.com/results/088503e5-1903-429e-b940-5ac4c73bd5a2/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-08-16 02:25:19 UTC

Tags:

etherhiding websocket

Link:

https://app.any.run/tasks/92143451-8dbe-4a9d-964b-64c3b1daf38e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/81358/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.75758532.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a811f9b44a6097a00b538d4/reports/233d6aad-6318-4635-9893-bc52703e7ede/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-08-15T23:01:00Z UTC

Last seen:

2026-08-16T12:20:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1/results?tab=lookup

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0723a204-5f27-4297-be3d-323a733d55cc

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/04933ea6ce91169b03d5a1dc28ac9959

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1/

ReversingLabs TitaniumCloud Win64.Trojan.Egairtigado

Threat name:

Win64.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-16 03:10:29 UTC

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o6mbznzxbwvkicpix5gng4axouk32claeq6dx7mo6k2pwkyzbpiq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/260816-cwhvnaag89/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Deletes itself

Executes dropped EXE

Registers new Windows logon scripts automatically executed at logon.

UnpacMe

Unpacked files

SH256 hash:

77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1

MD5 hash:

04933ea6ce91169b03d5a1dc28ac9959

SHA1 hash:

e7be100d8b31f8b0c42a06c44abf8b595d0b123b

Link:

https://www.unpac.me/results/65e42814-1c4d-4f6e-aeb9-34933cc36613/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/81358/

  

URLhaus

https://urlhaus.abuse.ch/url/3894883/