MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Intelligence 12 IOCs YARA 41 File information Comments

SHA256 hash:	7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d
SHA3-384 hash:	cc7c3c11b900bbf962a5d56286978ca696c0dbc7168f4bb3cb0023637df901a1238d9bac47f6cc8b9623303e2373e7ee
SHA1 hash:	c590a1e8ed1e884f18aabcee9546ae6171035242
MD5 hash:	281d2ca40691bfa0debcfb96c81b6cd8
humanhash:	ack-social-bacon-three
File name:	wp.exe
Download:	download sample
File size:	10'170'880 bytes
First seen:	2026-02-22 18:17:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	196608:BPxdtVBFUcwti7TQlyVN8iNISRTRmW5QD:NZHwtQQlyXOOQ
TLSH	T1CAA6F102F3E48A61E9FB467991B216129772B4268331D7CF339C85691F33BD19A36327
TrID	91.1% (.EFI) Extensible Firmware Interface x86-64 application (249620/49/65) 2.3% (.EXE) Win64 Executable (generic) (6522/11/2) 1.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.6% (.EXE) Win32 Executable (generic) (4504/4/1) 0.7% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	juroots
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

100

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

_7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d.exe

Verdict:

Malicious activity

Analysis date:

2026-02-22 18:44:50 UTC

Tags:

crypto-regex winpeas tool

Link:

https://app.any.run/tasks/602618f0-621a-46ac-b4b9-277bae6baebb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/54097/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.74462972.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699b48668fffa866e3b0b573

Tags:

dropper virus msil

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %temp% subdirectories

Using the Windows Management Instrumentation requests

Launching a process

DNS request

Creating a window

Searching for synchronization primitives

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d

Verdict:

Clean

File Type:

exe x64

First seen:

2025-11-16T10:14:00Z UTC

Last seen:

2026-02-13T17:48:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d/results?tab=lookup

Malware family:

BrowserGhost

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/12037442-75a5-460d-bb5e-1b55d597513e

Score:

69%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d

Verdict:

inconclusive

YARA:

8 match(es)

Tags:

.Net Executable Fody/Costura Packer Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.00 SOS: 0.15 SOS: 0.18 SOS: 0.23 SOS: 0.24 SOS: 0.25 SOS: 0.26 SOS: 0.27 SOS: 0.30 SOS: 0.31 SOS: 0.37 SOS: 0.38 Win 64 Exe x64

Link:

https://app.malva.re/file/281d2ca40691bfa0debcfb96c81b6cd8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d

Threat name:

ByteCode-MSIL.Hacktool.Aikaantivm

Status:

Malicious

First seen:

2025-11-17 05:10:38 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

24 of 36 (66.67%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pfc7tthxyitbuv2bwxkbak4jbhkis5xqi7thggijcqjh7krbbewq._file

Verdict:

malicious

Label(s):

hacktool_winpeas

Similar samples:

error

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Link:

https://tria.ge/reports/260222-ww94padw9g/

Behaviour

Checks processor information in registry

Gathers system information

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Network Configuration Discovery: Wi-Fi Discovery

Checks installed software on the system

Checks whether UAC is enabled

Enumerates connected drives

Network Share Discovery

Loads dropped DLL

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d

MD5 hash:

281d2ca40691bfa0debcfb96c81b6cd8

SHA1 hash:

c590a1e8ed1e884f18aabcee9546ae6171035242

Link:

https://www.unpac.me/results/c0d3135d-66a0-47cb-8b73-dae8b7652ab0/

SH256 hash:

7566167e2ec492eed39418fd541614eebcfa54024b58bb4a7b2699a172d6fe18

MD5 hash:

f7d0d51079b9974f2903c253e137b719

SHA1 hash:

96e27a37a0acdac2138839ec4f6694b340d674ad

Link:

https://www.unpac.me/results/c0d3135d-66a0-47cb-8b73-dae8b7652ab0/

SH256 hash:

3a0271d07789bfa8b3bc0ea01dbc06d8829bc6942b65988ce950ab3171e8f2a4

MD5 hash:

601d7cfebfcbafded5f5e9920560345b

SHA1 hash:

c74bbb2e455327d305d42efb0e782af09a1bc243

Link:

https://www.unpac.me/results/c0d3135d-66a0-47cb-8b73-dae8b7652ab0/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7945f9ccf7c2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	HKTL_NET_GUID_privilege_escalation_awesome_scripts_suite Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects .NET red/black-team tools via typelibguid
Reference:	https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite

Rule name:	hunt_credaccess_iis_xor Create hunting rule
Author:	SBousseaden
Description:	hunt for strings related to iis credential access

Rule name:	INDICATOR_EXE_Packed_Fody Create hunting rule
Author:	ditekSHen
Description:	Detects executables manipulated with Fody

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	INDICATOR_TOOL_PWS_SharpWeb Create hunting rule
Author:	ditekSHen
Description:	detects all versions of the browser password dumping .NET tool, SharpWeb.

Rule name:	Jupyter_infostealer Create hunting rule
Author:	CD_R0M_
Description:	Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	Windows_Hacktool_Seatbelt_674fd535 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Hacktool_WinPEAS_ng_23fee092 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, File analysis module

Rule name:	Windows_Hacktool_WinPEAS_ng_413caa6b Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, event module

Rule name:	Windows_Hacktool_WinPEAS_ng_4a9b9603 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Services info module

Rule name:	Windows_Hacktool_WinPEAS_ng_4db2c852 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, System info module

Rule name:	Windows_Hacktool_WinPEAS_ng_57587f8c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Network module

Rule name:	Windows_Hacktool_WinPEAS_ng_66197d54 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, application module

Rule name:	Windows_Hacktool_WinPEAS_ng_861d3264 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, File Info module

Rule name:	Windows_Hacktool_WinPEAS_ng_b6bb3e7c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Windows credentials module

Rule name:	Windows_Hacktool_WinPEAS_ng_bcedc8b2 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, User info module

Rule name:	Windows_Hacktool_WinPEAS_ng_cae025b1 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Process info module

Rule name:	Windows_Hacktool_WinPEAS_ng_e8ed269c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, checks module

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 7945f9ccf7c2261a5741b5d4102b8909d48976f047e673190914127faa21092d

(this sample)

Cape

https://www.capesandbox.com/analysis/54097/

URLhaus

https://urlhaus.abuse.ch/url/3784051/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample