MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b770d8047ec3b7eef509b23b29953d9f5bc1a3ffe3edb49d9c706f4fedbaba8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 6 File information Comments

SHA256 hash:	7b770d8047ec3b7eef509b23b29953d9f5bc1a3ffe3edb49d9c706f4fedbaba8
SHA3-384 hash:	a2ef1aed2785d502de7bfaeb7c97f708d7df4306df949a1ab3543ac8140a6bae5db93db0e6683c48319405aeb41a43a4
SHA1 hash:	7677fa24e6346bbb5429807a757fedeb65103704
MD5 hash:	10cb0ee6d0e41a47594089cf0eb31ba5
humanhash:	kansas-oranges-emma-skylark
File name:	addCB08.tmp.exe
Download:	download sample
File size:	102'592 bytes
First seen:	2026-09-29 14:15:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 744 x AgentTesla, 442 x GuLoader)
ssdeep	1536:dOIyZoGOa6PEouK4Romu/T/w7ZlmNghoagrtN1jaLTvKiTGb6fvf7d4:dODZGPEouK454wlIEoaGRjSoWfvf7K
TLSH	T11AA3E101B364D023EAA25F314CE787A75DF69D6614B066470B50BE4EBC32352AF0FA5A
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	c4dadadad2f492c2 (149 x GuLoader, 52 x RemcosRAT, 23 x VIPKeylogger)
Reporter	PeterGabaldon
Tags:	exe signed

Code Signing Certificate

Organisation:	VALUELYTIC AGRO PRIVATE LIMITED
Issuer:	GlobalSign GCC R45 CodeSigning CA 2020
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-02-13T10:41:21Z
Valid to:	2026-02-14T10:41:21Z
Serial number:	6f13912d5762c53e149b2eab
Thumbprint Algorithm:	SHA256
Thumbprint:	723c8fcb0f5f0f5049e3686f57a4705b04bfe534c172d579199f25a8f1d85fbc
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NSIS

Details

Link:

https://research.acce.ciphertechsolutions.com/results/0bb68cd3-2f1a-43a8-9304-f68bfe472859/

Malware family:

n/a

ID:

File name:

addCB08.tmp.exe

Verdict:

No threats detected

Analysis date:

2026-09-29 12:15:21 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/6913f573-7024-473d-ac19-10f08610ba6b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/89661/

Detection(s):

SecuriteInfo.com.Variant.Jaik.72878.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm installer installer installer-heuristic masquerade microsoft_visual_cc nsis overlay reconnaissance

Link:

https://www.filescan.io/uploads/6abbc7fd87f490f90ec2738c/reports/7426eee6-813b-47f9-aff6-fb2ab88ae18f/overview

Verdict:

Malicious

Labled as:

Adware.ConvertAd

Link:

https://www.hybrid-analysis.com/sample/7b770d8047ec3b7eef509b23b29953d9f5bc1a3ffe3edb49d9c706f4fedbaba8

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b8f449ed-f419-4ffe-8474-9d3978f5d7e0

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1979383

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

70%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/7b770d8047ec3b7eef509b23b29953d9f5bc1a3ffe3edb49d9c706f4fedbaba8

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/10cb0ee6d0e41a47594089cf0eb31ba5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b770d8047ec3b7eef509b23b29953d9f5bc1a3ffe3edb49d9c706f4fedbaba8/

Threat name:

Win32.Malware.Nemesis

Status:

Malicious

First seen:

2026-09-29 14:16:18 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

14 of 36 (38.89%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pn3q3ach5q5x532qtmr3fgkt3h23ygr77y7nwsozy4dpj7w3voua._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/260929-rkr2hstv3r/

Behaviour

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unpacked files

SH256 hash:

7b770d8047ec3b7eef509b23b29953d9f5bc1a3ffe3edb49d9c706f4fedbaba8

MD5 hash:

10cb0ee6d0e41a47594089cf0eb31ba5

SHA1 hash:

7677fa24e6346bbb5429807a757fedeb65103704

Link:

https://www.unpac.me/results/af2bb69d-3256-4ea6-902e-c74c45739ef1/

SH256 hash:

56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

MD5 hash:

6c3f8c94d0727894d706940a8a980543

SHA1 hash:

0d1bcad901be377f38d579aafc0c41c0ef8dcefd

Link:

https://www.unpac.me/results/af2bb69d-3256-4ea6-902e-c74c45739ef1/

SH256 hash:

8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

MD5 hash:

cff85c549d536f651d4fb8387f1976f2

SHA1 hash:

d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

Link:

https://www.unpac.me/results/af2bb69d-3256-4ea6-902e-c74c45739ef1/

SH256 hash:

a793929232afb78b1c5b2f45d82094098bcf01523159fad1032147d8d5f9c4df

MD5 hash:

a35cdc9cf1d17216c0ab8c5282488ead

SHA1 hash:

ed8e8091a924343ad8791d85e2733c14839f0d36

Link:

https://www.unpac.me/results/af2bb69d-3256-4ea6-902e-c74c45739ef1/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string

Rule name:	NSIS Create hunting rule
Author:	kevoreilly
Description:	NSIS Integrity Check function

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks