MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd
SHA3-384 hash: 7816c5d5c686d622b9488ea168ab6cc70dc6d3936d0864cccc020a8709e851d040609d0e74068bf03bde8310d820a10e
SHA1 hash: 39f1db70479418b416e839b3c544156e541e0130
MD5 hash: d1ea5d47a9ee28656d5e742712da733f
humanhash: football-october-north-artist
File name:MIWIFIRepairTool.x86.exe
Download: download sample
File size:320'000 bytes
First seen:2025-12-04 20:08:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 96d3b47248dfa7c4da231a8ab233a3f6
ssdeep 6144:R2aw4PuLBlWQ86Bxiatjcs+P21hTl57sAOlNHf47T:64PuLfC6Bjtjcs+P21dlqV/kT
TLSH T196649E51B991C033C4B2183005769BA29A7DB8302F2545EFD3F42A7D9E746D0FA36BA7
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10522/11/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 33f08eb269d4b24c
Reporter juroots
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
CZ CZ
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
MDE_File_Sample_bdc7f127d318a27cec7ab992430cbc22de6cee32.zip
Verdict:
Malicious activity
Analysis date:
2024-04-03 15:17:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/89900360-d589-44a0-9bc7-948a3bd8e134

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42560/
Detection(s):
SecuriteInfo.com.Variant.Doina.30965.86631978.UNOFFICIAL
Create hunting rule

PUA.Win.Tool.TFTPD-1
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6931ea7c21e2f720d66c0a1e
Tags:
virus
Verdict:
Malicious
Labled as:
Doina.Generic
Link:
https://www.hybrid-analysis.com/sample/86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd
Verdict:
Adware
File Type:
exe x32
First seen:
2019-05-23T20:12:00Z UTC
Last seen:
2025-12-06T18:41:00Z UTC
Hits:
~100000
Detections:
not-a-virus:Server-FTP.Win32.SFH.wcb not-a-virus:HEUR:Server-FTP.Win32.SFH.gen
Link:
https://opentip.kaspersky.com/86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b27a5131-23a0-4280-bedc-5ff7c829d4ee
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1066094
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
31%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/d1ea5d47a9ee28656d5e742712da733f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd/
Verdict:
Malicious
Threat:
Server-FTP.Win32.SFH
Link:
https://tip.neiki.dev/file/86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd
Threat name:
Win32.PUA.Presenoker
Create hunting rule
Status:
Malicious
First seen:
2019-06-19 13:16:04 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
19 of 36 (52.78%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q3zfp55dp27pzvi6o2u4r2yyr2edjipwzlhq27lb5p5b7ljqiw6q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/251204-yxb96adn21/
Behaviour
System Location Discovery: System Language Discovery
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0219f217-a7c9-4edc-9e30-059f00973f29
Unpacked files
SH256 hash:
86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd
MD5 hash:
d1ea5d47a9ee28656d5e742712da733f
SHA1 hash:
39f1db70479418b416e839b3c544156e541e0130
Link:
https://www.unpac.me/results/71a35292-b908-4011-a4b5-156ee1c5dfb6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86f257f7a37ebefcd51e76a9c8eb188e8834a1f6cacf0d7d61ebfa1fad3045bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/42560/

Comments