🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f307f18f34b1c0e6bcc92a76b82c4c85ae7284c330043f658ff976f92bb0441. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f307f18f34b1c0e6bcc92a76b82c4c85ae7284c330043f658ff976f92bb0441
SHA3-384 hash: d55b46cf1c4657acee9c7f1664d6395c92fbdda04d582a7cc3e9de5a727665ac0a08b2d731438cf69afa18ceae2f798c
SHA1 hash: 1996d692fbb0bec26e9ab6d9a733f74dbcca1a35
MD5 hash: 4d5dc4fd84c59563acfa24ae03bb311b
humanhash: mango-lemon-hotel-diet
File name:45.141.27.27_SilentPayload.dll
Download: download sample
File size:19'456 bytes
First seen:2026-10-10 12:09:00 UTC
Last seen:Never
File type:DLL dll
MIME type:application/vnd.microsoft.portable-executable
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep 384:CM+aAjAXUSRPe2PzLX5dgWbWrphY6pt/nlTSN0vAXLdWOdIYR9K9r67:XAjcde2PzLXXgWbWrxnZpOPOr67
TLSH T198922A48A3E88B36C27E0B396D7203500378B957EA23F34D4FF8D63918727955B146BA
TrID 25.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
25.3% (.EXE) Win64 Executable (generic) (6522/11/2)
17.5% (.EXE) Win32 Executable (generic) (4504/4/1)
8.0% (.ICL) Windows Icons Library (generic) (2059/9)
7.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Darkfibr

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91355/
Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad0ad8ef4e17c78f715b190
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/7f307f18f34b1c0e6bcc92a76b82c4c85ae7284c330043f658ff976f92bb0441
Verdict:
Unknown
File Type:
executable.pe.32.dll
First seen:
2026-08-27T18:00:00Z UTC
Last seen:
2026-10-12T03:57:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7f307f18f34b1c0e6bcc92a76b82c4c85ae7284c330043f658ff976f92bb0441/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d618aba4-5a0c-4935-a9a7-41ec8a925ddf
Score:
63%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/7f307f18f34b1c0e6bcc92a76b82c4c85ae7284c330043f658ff976f92bb0441
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.30 Win 32 Exe x86
Link:
https://app.malva.re/file/4d5dc4fd84c59563acfa24ae03bb311b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f307f18f34b1c0e6bcc92a76b82c4c85ae7284c330043f658ff976f92bb0441/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p4yh6ghtjmoa426msktwxawezbnookcmgmaeh5sy76lw7ev3araq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261010-qajrqads8p/
Unpacked files
SH256 hash:
7f307f18f34b1c0e6bcc92a76b82c4c85ae7284c330043f658ff976f92bb0441
MD5 hash:
4d5dc4fd84c59563acfa24ae03bb311b
SHA1 hash:
1996d692fbb0bec26e9ab6d9a733f74dbcca1a35
Link:
https://www.unpac.me/results/68284785-9f99-41d2-ab71-2c6aeb336656/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/91355/

Comments