MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83b5702983d5b720191aac2e8731c3df847bf1b4bbeadd520ed4c86342f5f1d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83b5702983d5b720191aac2e8731c3df847bf1b4bbeadd520ed4c86342f5f1d0
SHA3-384 hash: 68114c4fd8d9e4ca1700f9ba29987fb512180f35d6dbb4e9ef86f4816e0b8bfe94ddad41e3fa20ae519a1e98ca3c3a2d
SHA1 hash: 46e55809cf49588d057a7a6135fbb1cc5ec5a635
MD5 hash: 9dca0954ddd120503f49b50a7d9bdfe8
humanhash: pennsylvania-comet-indigo-uniform
File name:file
Download: download sample
File size:20'260'864 bytes
First seen:2026-07-22 17:31:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ba470d911d996b80541ffc849183463b
ssdeep 393216:Te4ixM5E9/ILKAvTyyzrwe1tO8MDXi8+uDvcSxpZZn4gyXUMMFnweN5sTu+N6lJY:Te+E/I+wTHH1tO8Mbi8VDvckgU9au+N8
TLSH T1CA17F06DCE3E09658D7635F88CCB17C7AC485B9906209EBB5B7E8C66630453EB0A313D
TrID 50.0% (.EXE) Generic Win/DOS Executable (2002/3)
49.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 54d4519b8a3a554e
Reporter Bitsight
Tags:d52f85 dropped-by-amadey exe


Avatar
Bitsight
url: http://62.60.226.140/files/8180653200/xNlSXnC.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
194
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75701/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Launching the process to change network settings
Searching for synchronization primitives
Launching the process to change the firewall settings
Launching a service
Creating a file in the %temp% directory
Creating a process from a recently created file
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug microsoft_visual_cc reconnaissance
Link:
https://www.filescan.io/uploads/6a60feb2f3f8584e1b7cf1fc/reports/1293bb49-5e6f-4f31-93b9-2da55c11d62d/overview
Verdict:
Suspicious
Labled as:
Win64/GenKryptik.HSTJ trojan
Link:
https://www.hybrid-analysis.com/sample/83b5702983d5b720191aac2e8731c3df847bf1b4bbeadd520ed4c86342f5f1d0
Score:
88%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/83b5702983d5b720191aac2e8731c3df847bf1b4bbeadd520ed4c86342f5f1d0
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/9dca0954ddd120503f49b50a7d9bdfe8
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qo2xakmd2w3sagi2vqxiomod36chx4nuxpvn2uqo2teggqxv6hia._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/260722-v34d2swyaw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtCreateThreadExHideFromDebugger
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/83b5702983d5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/83b5702983d5b720191aac2e8731c3df847bf1b4bbeadd520ed4c86342f5f1d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 83b5702983d5b720191aac2e8731c3df847bf1b4bbeadd520ed4c86342f5f1d0

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75701/

Comments