MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72
SHA3-384 hash:	fdbd9f9a05db13c6a114f57465fb6efb8a6eb4657225b8b8ecfec4c023d167f84635630237e1405ce841aad3684b980f
SHA1 hash:	c52a152e2a5b150936c6ac7d723f2883f043c5b2
MD5 hash:	256a2c7e8913d763a6510f561dbed7a1
humanhash:	spaghetti-salami-yankee-arizona
File name:	8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72.exe
Download:	download sample
File size:	2'989'568 bytes
First seen:	2026-08-12 22:24:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	44140cbbe125df54636c585913f74c75
ssdeep	49152:TFWXPM677rPksxo+2Dw7POzuhSlu8s8gk7ZJeSA6Qr2/FE9aIHuBDw9dfLZY:TOPX77nxo+TPOzuauz8gk7ZJM2/FEOmo
TLSH	T157D5239A7CF358B4D07AC3318FD3E8AD71693B8587614E9B36CC5D409D228889C7A778
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	whack_sh
Tags:	exe whack.sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

119

Origin country :

US

Vendor Threat Intelligence

ACCE VMProtect_Packer_PE

Details

Link:

https://research.acce.ciphertechsolutions.com/results/92fd569a-e2c6-4f6d-972a-d2d950329945/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-08-12 22:32:59 UTC

Tags:

websocket etherhiding

Link:

https://app.any.run/tasks/6918ba41-5589-4544-b563-e1bbdffbf33d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/80788/

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac5966acd90935a47f0cb5f

Tags:

vmprotect virus agent

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a7cf29c8b32d414522700ed/reports/97bcf092-22ef-4c45-93db-636a32b4cd32/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-08-12T17:52:00Z UTC

Last seen:

2026-08-14T01:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72/results?tab=lookup

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/43aa5abc-e19f-4af9-84b8-616e1e23d1cf

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/256a2c7e8913d763a6510f561dbed7a1

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72/

ReversingLabs TitaniumCloud Win64.Trojan.Qwexlafiba

Threat name:

Win64.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-12 23:10:20 UTC

File Type:

PE+ (Exe)

AV detection:

15 of 23 (65.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rzl7klizsuvxmg4cukfvfbyf34pd2yd3juyxxq6zn4ncp6befvza._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/260812-2bls9afk71/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Deletes itself

Executes dropped EXE

Registers new Windows logon scripts automatically executed at logon.

UnpacMe

Unpacked files

SH256 hash:

8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72

MD5 hash:

256a2c7e8913d763a6510f561dbed7a1

SHA1 hash:

c52a152e2a5b150936c6ac7d723f2883f043c5b2

Link:

https://www.unpac.me/results/784d95cd-628b-458c-a7f3-6f7cf3724d85/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/80788/

  

URLhaus

https://urlhaus.abuse.ch/url/3894883/