🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 965a23ca69216a7c85614c4311a64aaa17dcf8e4c3a29dcb29b54dc9c9539d42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 965a23ca69216a7c85614c4311a64aaa17dcf8e4c3a29dcb29b54dc9c9539d42
SHA3-384 hash: 425dd699bddaa28066a9c14a33c3b7d7c1a1d8490aae696695c102bfe1d988e17d04f7539dbc565e9b30602046b8fea4
SHA1 hash: 0d694c1664b3cc3a243bcf7f6ae3e9b115b2880f
MD5 hash: 2802c4229f885b0f6f7896687616200b
humanhash: lithium-romeo-timing-high
File name:965a23ca69216a7c85614c4311a64aaa17dcf8e4c3a29dcb29b54dc9c9539d42
Download: download sample
File size:2'465'944 bytes
First seen:2026-10-19 12:51:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash bb3ac2c21e02c68abcad237dc3fa6d00 (1 x SalatStealer)
ssdeep 24576:XL4GkFh5VVT8pyI0vUDZNK+hWayipHgXau9V+jY:b85Qp3002+uSHgXau92Y
TLSH T10DB51A8163189231D86321BCD7DF99197978E08B32E0379311F57B0DD98B83C957AAEB
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon e4b4d2f2f0b2d2d8
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
EG EG
Vendor Threat Intelligence
Malware configuration found for:
ReadyToRun
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9b10c7ff-5ea9-4785-98c2-ddd237facf0a/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-19 13:54:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6c411e32-d3a9-44aa-875d-e812ddfddf5c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/92871/
Detection(s):
SecuriteInfo.com.BAT.Rd-1.UNOFFICIAL
Create hunting rule

Win.Tool.Tedy-9970346-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad6127e5a22ac805bd7eac7
Tags:
ransomware dropper virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating synchronization primitives
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm certutil cmd dllhost dotnet evasive explorer findstr fingerprint fingerprint icacls ipconfig lolbin lolbin microsoft_visual_cc mpcmdrun msbuild msdt msiexec netsh overlay packed packed reconnaissance reg rundll32 taskkill timeout wevtutil.exe whoami wmic wmic wuauclt
Link:
https://www.filescan.io/uploads/6ad6127d2e70e06b1f3303bb/reports/9386b0e5-d242-4762-aec3-f55ddee82f75/overview
Verdict:
Suspicious
Labled as:
Tool.Tedy
Link:
https://www.hybrid-analysis.com/sample/965a23ca69216a7c85614c4311a64aaa17dcf8e4c3a29dcb29b54dc9c9539d42
Verdict:
Unknown
File Type:
exe x64
Link:
https://opentip.kaspersky.com/965a23ca69216a7c85614c4311a64aaa17dcf8e4c3a29dcb29b54dc9c9539d42/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/fab72efd-d43f-48ee-93e5-f389c3b651f9
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/965a23ca69216a7c85614c4311a64aaa17dcf8e4c3a29dcb29b54dc9c9539d42
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/2802c4229f885b0f6f7896687616200b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/965a23ca69216a7c85614c4311a64aaa17dcf8e4c3a29dcb29b54dc9c9539d42/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sznchstjefvhzblbjrbrdjskvil5z6heyorj3szjwvg4tskttvba._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261019-p36arafg66/
Behaviour
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
965a23ca69216a7c85614c4311a64aaa17dcf8e4c3a29dcb29b54dc9c9539d42
MD5 hash:
2802c4229f885b0f6f7896687616200b
SHA1 hash:
0d694c1664b3cc3a243bcf7f6ae3e9b115b2880f
Detections:
triage_underground_ransomware
Create hunting rule
INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
INDICATOR_SUSPICIOUS_DeleteRecentItems
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
Create hunting rule
INDICATOR_SUSPICIOUS_USNDeleteJournal
Create hunting rule
Link:
https://www.unpac.me/results/b0c53972-b1a2-42b6-8aa9-759ab8746a95/
SH256 hash:
e0bf274436cebc2a8a6e1b5dbe5b585aa3a53c5fad05dae3d3eb1506e0c049bb
MD5 hash:
9b16b17e3fa32e120beaf3b4b40d30b4
SHA1 hash:
197becd50327bd03f51bef87a6d55acf07519d34
Detections:
triage_underground_ransomware
Create hunting rule
INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
INDICATOR_SUSPICIOUS_DeleteRecentItems
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
Create hunting rule
INDICATOR_SUSPICIOUS_USNDeleteJournal
Create hunting rule
Link:
https://www.unpac.me/results/b0c53972-b1a2-42b6-8aa9-759ab8746a95/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/965a23ca69216a7c85614c4311a64aaa17dcf8e4c3a29dcb29b54dc9c9539d42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BatModifier2
Create hunting rule
Author:Madhav
Description:This is a bat file which is setup a game. 49509
Rule name:CMD_Shutdown
Create hunting rule
Author:adm1n_usa32
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dgaaga
Create hunting rule
Author:Harshit
Description:Detects suspicious PowerShell or registry activity
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
Author:ditekSHen
Description:Detects executables containing commands for clearing Windows Event Logs
Rule name:INDICATOR_SUSPICIOUS_DeleteRecentItems
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding anti-forensic artifacts of deleting Windows Recent Items
Rule name:INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
Create hunting rule
Author:ditekSHen
Description:Detects executables calling ClearMyTracksByProcess
Rule name:INDICATOR_SUSPICIOUS_USNDeleteJournal
Create hunting rule
Author:ditekSHen
Description:Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:SUSP_ENV_Folder_Root_File_Jan23_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious file path pointing to the root of a folder easily accessible via environment variables
Reference:Internal Research
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_180e12ce_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/92871/

Comments