MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 856ffb542edcc8cf33a6aa5b95b1aba4ad83fa2e2042c6a7f9a73ef156dccf86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	856ffb542edcc8cf33a6aa5b95b1aba4ad83fa2e2042c6a7f9a73ef156dccf86
SHA3-384 hash:	d5ef0814ee4b15b11c818a9c3680f4c3fe3d4f4413253bdd1cac5ed422a1cbe7d22f48ccc0ceee347219055e90f07b59
SHA1 hash:	02237f86aad0e822053dbf90a515892c7e17bbd7
MD5 hash:	7241b7bd1ec797e439e971b389c4e74f
humanhash:	pizza-freddie-wolfram-gee
File name:	856ffb542edcc8cf33a6aa5b95b1aba4ad83fa2e2042c6a7f9a73ef156dccf86
Download:	download sample
File size:	90'463'232 bytes
First seen:	2026-01-09 10:19:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9bf3f5698d1c8e5d8bbe8d194ac5d544
ssdeep	786432:dAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:dAZui3zQz2jOZKft
TLSH	T1CD187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	adrian__luca
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

353

Origin country :

HU

Vendor Threat Intelligence

ACCE MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a0f58476-6fb6-47cb-91bc-47389ea81ba8/

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

856ffb542edcc8cf33a6aa5b95b1aba4ad83fa2e2042c6a7f9a73ef156dccf86

Verdict:

Suspicious activity

Analysis date:

2026-01-09 10:22:40 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/77aa04a3-cb0c-4c56-875e-ee68cf57e72a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6960d6d4f50945831dff3138

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Restart of the analyzed sample

Creating a process with a hidden window

Sending a custom TCP request

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Connection attempt to an infection source

Query of malicious DNS domain

Sending a TCP request to an infection source

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug crypto fingerprint microsoft_visual_cc

Link:

https://www.filescan.io/uploads/6960d64d07ef5fa68e828020/reports/9d1e8c25-b11d-4bb0-8cbc-07d0266d2a6d/overview

Hybrid Analysis Trojan_Win32_Kepavll_rfn

Verdict:

Malicious

Labled as:

Trojan_Win32_Kepavll_rfn

Link:

https://www.hybrid-analysis.com/sample/856ffb542edcc8cf33a6aa5b95b1aba4ad83fa2e2042c6a7f9a73ef156dccf86

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-12-20T02:53:00Z UTC

Last seen:

2026-01-09T09:37:00Z UTC

Hits:

~1000

Detections:

Trojan.Win32.Inject.sb BSS:Trojan.Win32.Generic Trojan.Win32.Inject.aqvqx RiskTool.BitCoinMiner.TCP.C&C

Link:

https://opentip.kaspersky.com/856ffb542edcc8cf33a6aa5b95b1aba4ad83fa2e2042c6a7f9a73ef156dccf86/results?tab=lookup

Nucleon Malprob Malware

Score:

76%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/856ffb542edcc8cf33a6aa5b95b1aba4ad83fa2e2042c6a7f9a73ef156dccf86

CERT.PL MWDB

Gathering data

Neiki Trojan.Win32.Inject

Verdict:

Malicious

Threat:

Trojan.Win32.Inject

Link:

https://tip.neiki.dev/file/856ffb542edcc8cf33a6aa5b95b1aba4ad83fa2e2042c6a7f9a73ef156dccf86

ReversingLabs TitaniumCloud Win64.Trojan.Kepavll

Threat name:

Win64.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-20 00:37:34 UTC

File Type:

PE+ (Exe)

Extracted files:

11

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qvx7wvbo3tem6m5gvjnzlmnluswyh6roebbmnj7zu47pcvw4z6da._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260109-mdtjjsgt2c/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/3cb70cbb-0ef4-4198-be5b-6ec7a383dbaa

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.