MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817
SHA3-384 hash: a146c85d100efde2438380c14681cefd474038f58912080a8564020ce95174f5ff3a184fcbc97d23cd2eafe7218d644b
SHA1 hash: 762bcdd21ae0b1a1127f292b566520ed8fbb9057
MD5 hash: 2dad7be6f9a740de151fb62d74dd8541
humanhash: kilo-georgia-muppet-west
File name:82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817
Download: download sample
File size:11'264 bytes
First seen:2025-10-10 06:29:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 96:mHqYkvU4H4g6X/wmUoXVkksg/Lcu54KyPImklmizNt:gqbU4XNAlkkslu54KyOlmE
Threatray 277 similar samples on MalwareBazaar
TLSH T18532F7551B84C325E0B34B71A8B3C7415278EE08AD27DB5F3D88720A2EB27806A53776
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
46
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817
Verdict:
Malicious activity
Analysis date:
2025-10-10 07:32:35 UTC
Tags:
purecrypter netreactor stealer auto-startup
Link:
https://app.any.run/tasks/14ff83a9-fa6a-4f28-8654-7e279175e3d9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/32041/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e8a89c8b7b147cc4b68958
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Connection attempt to an infection source
DNS request
Connection attempt
Sending an HTTP GET request
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
barys obfuscated
Link:
https://www.filescan.io/uploads/68e8ab8471883144ef2fe5e7/reports/0c309906-76e6-4cbd-9c03-6f3eb1fc2069/overview
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-14T20:55:00Z UTC
Last seen:
2025-10-08T00:50:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/bdeffd7b-e299-4c36-bf1d-60c22fcd7e73
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817/
Threat name:
ByteCode-MSIL.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2025-09-15 00:12:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
27 of 37 (72.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qlngd3gadruba4us4pna4qvlnvtofoxq2edbtfnkeya6edc63alq._file
Verdict:
malicious
Label(s):
unc_loader_078
Create hunting rule
Similar samples:
049812e47d5334275a82320a30608d9a8e3fb192c340980f67e31375c96eae70
11ea3046a5ea0ca54c9efee2b7a7f9da06d2a5bed1bb41447673d4ae0374c2d3
2a46d19000e158b9468a7748e4d88146e8d7e47aa6e98bdb1b5791b1353d65b8
4fc88ca523289388c3016c7d9d59134d6a346bc2cbbe2da45809a3d17fe958b4
5b88e8e2e95d7b73ffa6bcc1f2bcb4d4791340993ed30c84663c907ad50ae6c2
a7ea2f8cf65a2fc6368cbe91431080aa1269cc37de7095a15237d1b411f27d93
b13e974aa3bb30239ff57db566dac32c1c19a2323eecbb785890224549444254
df6eac509b37b2dfe3ced246b01167bf4c9d82a3ba0d20b3f3da90072dbd0d99
error
fd43d26f1db150f1ce6faa221521e0ac9d32ffc26fc835bdc564ce6d93a5ee84
+ 267 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/251010-hkh9ya1nv6/
Behaviour
Suspicious use of AdjustPrivilegeToken
System Location Discovery: System Language Discovery
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ff2074b6-e99a-4535-9e7d-8d9bbeafbb9a
Unpacked files
SH256 hash:
82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817
MD5 hash:
2dad7be6f9a740de151fb62d74dd8541
SHA1 hash:
762bcdd21ae0b1a1127f292b566520ed8fbb9057
Link:
https://www.unpac.me/results/d42a53ac-cca4-4ea2-b308-bc6e676d2109/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82da61ecc01c68107292e3da0e42ab6d66e2baf0d1061995aa2601e20c5ed817

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/32041/

Comments