🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28
SHA3-384 hash: 18135c9f872b1aad6716cc548d5ce6ad6e87560dceeb65e587d0e6eedc042abdf6367e46f0dba5f0f0da5efb075bd97d
SHA1 hash: f4a47daf3a0ca732bcb1e3f9a70f74ba8c1d0552
MD5 hash: d24bed48bd5cbf37214322ea6beca2d7
humanhash: london-summer-seven-ceiling
File name:7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28
Download: download sample
File size:720'632 bytes
First seen:2026-11-09 07:50:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 8b21ff8a0d0059e9d67b568f049de051
ssdeep 12288:+a2h0bd1iV5iDEuPAlFJ+yqNaZhvWI4s/rzqqB33B4eFo5krfxhQNoa/xfuS3Bge:+a2i1EhqAlFJ++Zhvl/ruqpx46o5wAT7
TLSH T12DE43365E601480BF85F0B7926DF4920D448BD46B94E4AEFE436345F6E34E388E27C4B
TrID 38.2% (.EXE) UPX compressed Win32 Executable (27066/9/6)
37.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
9.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon abae0feec6ebceef
Reporter adrian__luca
Tags:exe UPX
File size (compressed) :720'632 bytes
File size (de-compressed) :769'272 bytes
Format:win32/pe
Unpacked file: e85705e650bc584666d7d093d5cde8ee139ab9cc6ec66338826b06cbfa1f16da

Intelligence

File Origin
# of uploads :
1
# of downloads :
49
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
PEPacker
Details
Link:
https://research.acce.ciphertechsolutions.com/results/58033f67-a0f8-40cb-981f-38ce2c2cca18/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-09 10:44:43 UTC
Tags:
upx
Link:
https://app.any.run/tasks/2d0f8513-ea2e-4947-98f1-254937918b05

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/98133/
Detection(s):
PUA.Win.File.Pemalform-7668173-0
Create hunting rule

PUA.Win.Packer.Aspack-29
Create hunting rule

PUA.Win.Packer.Aspack-30
Create hunting rule

PUA.Win.Packer.RarSfx-1
Create hunting rule

PUA.Win.Packer.RarSfxModificat-1
Create hunting rule

PUA.Win.Packer.TeLock-1
Create hunting rule

PUA.Win.Packer.Telock-11
Create hunting rule

PUA.Win.Packer.Telock-12
Create hunting rule

PUA.Win.Packer.Telock-3
Create hunting rule

PUA.Win.Packer.Telock-5
Create hunting rule

PUA.Win.Packer.Telock-8
Create hunting rule

PUA.Win.Trojan.Packed-185
Create hunting rule

SecuriteInfo.com.PSW.Generic.LFI.7531.8597.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Generic12.BBVQ.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.TR.PWS.Sinowal.Gen.12650.26169.21099.UNOFFICIAL
Create hunting rule

Win.Trojan.Agent-192767
Create hunting rule

Win.Trojan.Greenstuff-3
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1c2b01492c978625a677d
Tags:
autorun packer trojan virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating synchronization primitives
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28
Verdict:
Malicious
File Type:
exe x32
Link:
https://opentip.kaspersky.com/7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/42e157be-bd8c-4b23-9503-17ab0296b4c6
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout UPX Win 32 Exe x86
Link:
https://app.malva.re/file/d24bed48bd5cbf37214322ea6beca2d7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28/
Threat name:
Win32.Infostealer.Pasorot
Create hunting rule
Status:
Malicious
First seen:
2026-11-07 06:36:00 UTC
File Type:
PE (Exe)
Extracted files:
223
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6thxm4g5wu27qch6jd2nwd547makyk436uirxmwuye2wh6pjyua._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery upx
Link:
https://tria.ge/reports/261109-jpzm6adf84/
Behaviour
Suspicious use of SetWindowsHookEx
System Location Discovery: System Language Discovery
UPX packed file
Malware Family:
greenstuff
Create hunting rule
Malicious:
True
Tags:
file-overlay upx peexe obfuscated
Link:
https://intel.virussign.com/intelligence/file/7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28
Unpacked files
SH256 hash:
7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28
MD5 hash:
d24bed48bd5cbf37214322ea6beca2d7
SHA1 hash:
f4a47daf3a0ca732bcb1e3f9a70f74ba8c1d0552
Link:
https://www.unpac.me/results/14d2da0f-9912-465d-9c6e-aff4c7bc5f9b/
SH256 hash:
b6950874c866afdfeb773c6b6fc3b01144eeff76ac93d9428e96bdbc07d006bc
MD5 hash:
25b8d7a32ce4306a0bb00717c55f0b0d
SHA1 hash:
1d4653eb45564c27e90788c2146a26731a345ca4
Link:
https://www.unpac.me/results/14d2da0f-9912-465d-9c6e-aff4c7bc5f9b/
SH256 hash:
e85705e650bc584666d7d093d5cde8ee139ab9cc6ec66338826b06cbfa1f16da
MD5 hash:
9c8b1914731f8d5c0bc5bca9cf1aa82f
SHA1 hash:
f10327d1cf420231b81b51f5865a23bb11cd9347
Link:
https://www.unpac.me/results/14d2da0f-9912-465d-9c6e-aff4c7bc5f9b/
SH256 hash:
0c2f60b6a811caa06bcf1569d7cf16d31b4310897c00a8766a0d01b48360f8fa
MD5 hash:
f5915e577b526da433b052e38b1a36eb
SHA1 hash:
ac168ae1d81424643c0a32f1585a4f12650b9563
Link:
https://www.unpac.me/results/14d2da0f-9912-465d-9c6e-aff4c7bc5f9b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.99
Link:
https://yomi.yoroi.company/submissions/7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_3
Create hunting rule
Author:Kevin Falcoz
Description:UPX 3.X
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Executable exe 7fa67bb386eda9afc047f247a6d87de7d805615cdfa888dd96a609ab1fcf4e28

(this sample)

Executable exe e85705e650bc584666d7d093d5cde8ee139ab9cc6ec66338826b06cbfa1f16da

Cape
Cape
https://www.capesandbox.com/analysis/98133/
  
Dropping
SHA256 e85705e650bc584666d7d093d5cde8ee139ab9cc6ec66338826b06cbfa1f16da
  
Dropping
MD5 9c8b1914731f8d5c0bc5bca9cf1aa82f

Comments