MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c
SHA3-384 hash: e1a08fc4d73a2c0fc25cea45a1dd5b434dc8b132a2e9963e54b0fafac1fbe4fbbf5074335a1296787a66403dfc1fdee8
SHA1 hash: e04bde4ed318d91b585880f776369f426f8cd42e
MD5 hash: 63c36c7e24be443872171b9b181bcf3b
humanhash: cola-lemon-sad-network
File name:SecuriteInfo.com.Variant.Genie.8DN.1477.1915.7798
Download: download sample
File size:996'864 bytes
First seen:2026-02-13 08:23:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'820 x AgentTesla, 19'743 x Formbook, 12'286 x SnakeKeylogger)
ssdeep 12288:NhnzRCOuNcY9BHP3tqgXOyhfWXzj25KgYTV6g9nhBpFW1qRgfi3gKJvxs8AlHiyX:f8OwHBHP3tl+BzC4gYFhBDWu2SJ2ML
TLSH T1A125230EEB7DBE11CF5F9777D6239901C0E645A36469F4AE0AC51CE328368DD8B8B814
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
DeepSea
DeepSea decrypted strings
Link:
https://research.acce.ciphertechsolutions.com/results/9d599ebd-bc1c-4dea-a1c5-546c431a840e/
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Genie.8DN.1477.1915.7798
Verdict:
Malicious activity
Analysis date:
2026-02-13 08:41:08 UTC
Tags:
purehvnc netreactor
Link:
https://app.any.run/tasks/4b20bcee-80c1-4981-abc9-210cade25f15

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53207/
Detection(s):
SecuriteInfo.com.Variant.Genie.8DN.1477.1915.7798.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698edfc61c4b7b977f661bdb
Tags:
virus micro msil
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/698edfbd981ff1d38a548939/reports/5e15d060-5003-458d-b4ab-8c09a8d4cf81/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-17T01:40:00Z UTC
Last seen:
2026-02-13T17:03:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/76ed95ed-5423-42bf-b1ba-4e9f5f69a402
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.37 Win 32 Exe x86
Link:
https://app.malva.re/file/63c36c7e24be443872171b9b181bcf3b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c/
Threat name:
Win32.Trojan.Genie
Create hunting rule
Status:
Malicious
First seen:
2025-12-17 05:04:16 UTC
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkld7ygrpbfpriwlnhvly5ezzrrfljzbfit7h4npjkjxiltksnga._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/260213-kawtdsgw3h/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c
MD5 hash:
63c36c7e24be443872171b9b181bcf3b
SHA1 hash:
e04bde4ed318d91b585880f776369f426f8cd42e
Link:
https://www.unpac.me/results/ad833925-525b-4bc7-9424-c990908f6659/
SH256 hash:
cc5205066334cbf6b43c3576be781dd7f8abbf6201fcc49ae8be4096dbe141a9
MD5 hash:
9e87def3594f539e96fb639cf5bcc8e1
SHA1 hash:
1eda4aa19e4895d6632ba0c83d25d9c6d4b3d23d
Link:
https://www.unpac.me/results/ad833925-525b-4bc7-9424-c990908f6659/
SH256 hash:
f0165139c20775849e588572006d55cfda1ac1c57d57a7e44700d3590d0ab327
MD5 hash:
4d34f971de9898a51817ebb064040d6e
SHA1 hash:
3420af0b0e05f03d6ce1d98522b83ea0c76c2cee
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/ad833925-525b-4bc7-9424-c990908f6659/
SH256 hash:
f7eb663a0675db35d1e15b18012b97307cc0354e4a8068cc140c282980799b2b
MD5 hash:
020499decff9caaed0e0ea960af5e034
SHA1 hash:
5f991ffff71071e3d5a8b1d8ddd966d6db00463a
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/ad833925-525b-4bc7-9424-c990908f6659/
Parent samples :
303cbaa4832011373afc6bbf1d761a470f4e9111cdd32112f12db68f2d19d5c3
c01020bddf0722615647d37dffb887e4110e7d20074ec1ac525ebe00a036c2e9
9569089d9460ec165d7c01d889e239a16155515867d198e8664e4327d07142b3
7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c
59b9ff739510ae6d1741c1835e79281a9394213e431627b11286a5691da49961
bd6352d2cc65a4ff636f327799f6cf0ae2715ccb9df5ad580b1544853b0c9d67
SH256 hash:
40f2b1834c0d4b0c93e75ff6f2608d346c6c289ca9c126947cc620b0dcb11961
MD5 hash:
5cfe230c941af2c19641bc66ef79cedf
SHA1 hash:
42b3f522888395a9c771b9d7803ee66171d13dd7
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/ad833925-525b-4bc7-9424-c990908f6659/
Parent samples :
957ab5ff285cb072d03de9cb8438820bde79ce9dfb59400a5b98dd45f6baa50e
7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.86
Link:
https://yomi.yoroi.company/submissions/7a963fe0d1784af8a2cb69eabc7499cc6255a7212a27f3f1af4a93742e6a934c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/53207/

Comments