MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0
SHA3-384 hash: abc5977d1d5b271233f2e7567a71771a7e448a950cc60ef7625eb3c276719f187e1b81ab13a48c5adce3ff83c044f273
SHA1 hash: bc6bce5c4b92ed02f096a36de15c662cffad68b7
MD5 hash: 2ed19ca51262a1c9574de796d91e5822
humanhash: kansas-virginia-idaho-ten
File name:5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184
Download: download sample
File size:1'673'216 bytes
First seen:2026-03-25 08:09:32 UTC
Last seen:2026-03-30 09:23:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ec48ec70eb0b70ff8aa67fca6235cb85
ssdeep 24576:eqaUDKLmINLKp/LSJxnxDv7fTiF6YIkPnFM6S3Z35jRS5oKElspyDrZv:NaFeLSJbve6yMf3ZJUyFZ
Threatray 36 similar samples on MalwareBazaar
TLSH T19A75BF40FBC241F2EE820A3151DAAB379F386B154725DDE3D2C02965DD206D1AB3E7AD
TrID 38.2% (.EXE) Win64 Executable (generic) (6522/11/2)
26.4% (.EXE) Win32 Executable (generic) (4504/4/1)
11.8% (.EXE) OS/2 Executable (generic) (2029/13)
11.7% (.EXE) Generic Win/DOS Executable (2002/3)
11.7% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:bambooware-ru eufr18-166-workdns-com exe upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184
File size (compressed) :756'736 bytes
File size (de-compressed) :1'673'216 bytes
Format:win32/pe
Packed file: 5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184

Intelligence

File Origin
# of uploads :
3
# of downloads :
128
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184
Verdict:
Malicious activity
Analysis date:
2026-03-25 08:15:54 UTC
Tags:
evasion telegram auto-reg auto-sch-xml
Link:
https://app.any.run/tasks/62be98e5-d83a-4b3c-91c9-d1861c6b5e96

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/59153/
Detection(s):
SecuriteInfo.com.Dump.Generic.Keylogger.2.54DA23A9.21894.27440.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c3987a390b996474138822
Tags:
shell sage smtp
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
DNS request
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Launching the process to change the firewall settings
Creating a file
Restart of the analyzed sample
Blocking the User Account Control
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Dump:Generic.Keylogger.2
Link:
https://www.hybrid-analysis.com/sample/8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0
Verdict:
Malicious
File Type:
exe x32
Detections:
UDS:DangerousObject.Multi.Generic
Link:
https://opentip.kaspersky.com/8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5773b0cd-d136-4663-a7aa-95ce237dcf32
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1888696
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Disables UAC (registry)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious PowerShell Parameter Substring
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1888696 Sample: 5b79e1023134e4093f5c6cdf8c6... Startdate: 25/03/2026 Architecture: WINDOWS Score: 100 48 t.me 2->48 50 lmtop.ma 2->50 52 ip-api.com 2->52 60 Antivirus detection for URL or domain 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 64 Multi AV Scanner detection for submitted file 2->64 66 3 other signatures 2->66 8 5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184.exe 1 4 2->8         started        13 5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184.exe 2->13         started        15 5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184.exe 2->15         started        17 3 other processes 2->17 signatures3 process4 dnsIp5 54 ip-api.com 208.95.112.1, 49695, 49701, 49730 TUT-ASUS United States 8->54 56 t.me 149.154.167.99, 443, 49705, 49711 TELEGRAMRU United Kingdom 8->56 58 2 other IPs or domains 8->58 46 C:\Users\user\Desktop\xml.xml, XML 8->46 dropped 72 Uses cmd line tools excessively to alter registry or file data 8->72 74 Uses schtasks.exe or at.exe to add and modify task schedules 8->74 76 Uses netsh to modify the Windows network and firewall settings 8->76 78 2 other signatures 8->78 19 powershell.exe 23 8->19         started        22 reg.exe 1 8->22         started        24 netsh.exe 2 8->24         started        28 4 other processes 8->28 26 WerFault.exe 13->26         started        file6 signatures7 process8 signatures9 68 Loading BitLocker PowerShell Module 19->68 30 WmiPrvSE.exe 19->30         started        32 conhost.exe 19->32         started        70 Disables UAC (registry) 22->70 34 conhost.exe 22->34         started        36 conhost.exe 24->36         started        38 conhost.exe 28->38         started        40 conhost.exe 28->40         started        42 conhost.exe 28->42         started        44 conhost.exe 28->44         started        process10
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout SFX 7z Win 32 Exe x86
Link:
https://app.malva.re/file/2ed19ca51262a1c9574de796d91e5822
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-03-25 08:10:29 UTC
File Type:
PE (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rlegb2z4pgmxuumj3sn66ynaigzppyas6vamtkxmso4u44qyzdya._file
Verdict:
malicious
Label(s):
unc_laoder_089
Create hunting rule
Similar samples:
101b0c403511a6b65070a6d0473081bc2190a9ef5f5b68defd352527b9711d29
41b73da2bad91ff5157f151685ab03b1992c5705aa7a28cd1c709a1515f1480d
5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184
8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0
ca4fef768aa2cd5657f8cc8a44b950c00793c1ea50d6f8c1fef78d22f18258df
eed3094d79da2864353baf862be2b811af5e28ea1dacd422f8332d64328acba2
error
+ 26 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
defense_evasion discovery
Link:
https://tria.ge/reports/260325-j2xdkag15j/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Looks up external IP address via web service
Unpacked files
SH256 hash:
8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0
MD5 hash:
2ed19ca51262a1c9574de796d91e5822
SHA1 hash:
bc6bce5c4b92ed02f096a36de15c662cffad68b7
Link:
https://www.unpac.me/results/68f30a16-6343-469a-9081-d49723c11e1e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8ac860eb3c79/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Executable exe 5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184

Executable exe 8ac860eb3c79997a5189dc9bef61a041b2f7e012f540c9aaec93b94e7218c8f0

(this sample)

  
Dropped by
SHA256 5b79e1023134e4093f5c6cdf8c618a68435724947883eacf914420172599f184
Cape
Cape
https://www.capesandbox.com/analysis/59153/
  
Dropped by
MD5 cad32343afb7db0e161762fd2b331868

Comments