MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 875dd7c1ef9a47fac8d3f50c945faf3afdea6e01d2d5c00f671110f62d97ebc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 875dd7c1ef9a47fac8d3f50c945faf3afdea6e01d2d5c00f671110f62d97ebc1
SHA3-384 hash: 5d7104ee6581b0afd57fe9315871171d58120099faf9d1fd97875b12e344ec9d038d3f60c93895ba3256de57a64c082b
SHA1 hash: 359af93f963931fd7ee3f87a224f79f438551db9
MD5 hash: e0e8880b691b81812ec0f17a4f9d363b
humanhash: alpha-romeo-pizza-ack
File name:libcurl.dll
Download: download sample
File size:4'448'944 bytes
First seen:2026-07-18 17:09:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d9cdd14f1e51bf231e8fd705275c2c8a
ssdeep 24576:zsSNeB0IJIVX8QS1LkV7XbiiJynl6iLswXFZ2Huy:DNgDIVMkV7XbiiAl625Z2HN
TLSH T162264B14A105CD2FCB133ABDF816AADD7B5458A2CB02C22F12B48ED769E73D1644EB47
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 449271f0f0709244
Reporter kejult
Tags:dll exe signed trojan Yogi

Code Signing Certificate

Organisation:Battery Monitor
Issuer:Battery Monitor
Algorithm:sha256WithRSAEncryption
Valid from:2026-07-11T12:17:26Z
Valid to:2027-07-11T12:27:26Z
Serial number: 539d57f1d60d4fa94c6585d323da1e99
Thumbprint Algorithm:SHA256
Thumbprint: e149e8568dcf8dd3c795c100f6fcab19d0e11e7ec3f4c5e3815770c00f275341
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
Quantum V4.zip
Verdict:
Suspicious activity
Analysis date:
2026-07-18 17:06:14 UTC
Tags:
arch-exec
Link:
https://app.any.run/tasks/7df76e2b-1565-4074-bc0d-7d137d6aed1f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75119/
Detection(s):
SecuriteInfo.com.Variant.Yogi.8429.82947479.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5bb35785479d70bfb76c22
Tags:
injection obfusc virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a service
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug masquerade overlay packed signed
Link:
https://www.filescan.io/uploads/6a5bb3509902898be6cf6f3c/reports/4045fe8c-09f0-45c7-b59f-f933dbb3eeca/overview
Verdict:
Malicious
Labled as:
Yogi.Generic
Link:
https://www.hybrid-analysis.com/sample/875dd7c1ef9a47fac8d3f50c945faf3afdea6e01d2d5c00f671110f62d97ebc1
Verdict:
Malicious
File Type:
dll x64
First seen:
2026-07-18T06:00:00Z UTC
Last seen:
2026-07-19T22:12:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/875dd7c1ef9a47fac8d3f50c945faf3afdea6e01d2d5c00f671110f62d97ebc1/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/58415d87-bad4-4d5c-a6c6-67514c8a31b1
Score:
32%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/875dd7c1ef9a47fac8d3f50c945faf3afdea6e01d2d5c00f671110f62d97ebc1
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/e0e8880b691b81812ec0f17a4f9d363b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/875dd7c1ef9a47fac8d3f50c945faf3afdea6e01d2d5c00f671110f62d97ebc1/
Threat name:
Win64.Trojan.Yogi
Create hunting rule
Status:
Malicious
First seen:
2026-07-18 10:43:52 UTC
File Type:
PE+ (Dll)
Extracted files:
6
AV detection:
19 of 37 (51.35%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q5o5pqpptjd7vsgt6ugjix5phl66u3qb2lk4ad3hceipmlmx5paq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260718-vpehrsgv6k/
Unpacked files
SH256 hash:
875dd7c1ef9a47fac8d3f50c945faf3afdea6e01d2d5c00f671110f62d97ebc1
MD5 hash:
e0e8880b691b81812ec0f17a4f9d363b
SHA1 hash:
359af93f963931fd7ee3f87a224f79f438551db9
Link:
https://www.unpac.me/results/628c0cf6-d2ba-49f9-9827-c0e3509af48e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/875dd7c1ef9a47fac8d3f50c945faf3afdea6e01d2d5c00f671110f62d97ebc1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 875dd7c1ef9a47fac8d3f50c945faf3afdea6e01d2d5c00f671110f62d97ebc1

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75119/

Comments