MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6
SHA3-384 hash: 3759da4b3c1fa1b74c3e73a5c080a238ffcc84a09db1ea733024ade35ec83c513703cf859020fd6e81096ef9cba60cc9
SHA1 hash: 16bcfee620cbad6c7ec95b4778b3491ab1dd1ebd
MD5 hash: 64da5be3526c62bfe98790317afae203
humanhash: skylark-georgia-pluto-batman
File name:SecuriteInfo.com.Win64.MalwareX-gen.48229661
Download: download sample
File size:336'384 bytes
First seen:2025-09-26 09:02:44 UTC
Last seen:2025-10-01 04:07:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4b81451c2b09da8f3b1e1cf753a2300a
ssdeep 6144:8jYpbEff7uFHEPDkEDScnwokqPUXohQFfw6rJxkhqA:8jyEX7+H2oEDSx0CoIfw6p
TLSH T10C647C19F2A514F8E5B79238C8565905EAB2BC160770DBEF13E04A562F332E09D3FB61
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
22
# of downloads :
104
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
gEcf95k.exe
Verdict:
Malicious activity
Analysis date:
2025-09-26 08:10:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/af86d679-9ef5-4c2d-a998-e83eecd1ee28

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29147/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.48229661.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d656f21e478398905204d6
Tags:
virus shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Launching a service
Searching for synchronization primitives
Sending an HTTP GET request
Creating a window
Adding a root certificate
Running batch commands
Launching a process
Using the Windows Management Instrumentation requests
Launching the process to change network settings
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Launching the process to interact with network services
Changing DNS server
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
cmd fingerprint lolbin microsoft_visual_cc netsh obfuscated
Link:
https://www.filescan.io/uploads/68d656efc564c8e81d084e12/reports/d0de3d7d-c028-42c6-98fd-dd4b3cea15ba/overview
Verdict:
Malicious
Labled as:
Doina.Generic
Link:
https://www.hybrid-analysis.com/sample/990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6
Verdict:
Clean
File Type:
exe x64
First seen:
2025-09-26T05:12:00Z UTC
Last seen:
2025-09-26T05:12:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/378e23fc-06ca-4909-a462-acb041ce3933
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/64da5be3526c62bfe98790317afae203
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6/
Verdict:
Malicious
Threat:
Win64.Malware.Doina
Link:
https://tip.neiki.dev/file/990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-09-26 08:10:28 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
17 of 38 (44.74%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=teetlndd5xq3izypfmkjuyia766ffwtxs2lxba6p74efzgjqfh3a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion persistence privilege_escalation spyware trojan
Link:
https://tria.ge/reports/250926-k1eykawvav/
Behaviour
Modifies data under HKEY_USERS
Modifies system certificate store
Runs net.exe
Suspicious use of WriteProcessMemory
Event Triggered Execution: Netsh Helper DLL
Unexpected DNS network traffic destination
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0fe7075f-1f01-415c-b36e-5e11f1cb5292
Unpacked files
SH256 hash:
990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6
MD5 hash:
64da5be3526c62bfe98790317afae203
SHA1 hash:
16bcfee620cbad6c7ec95b4778b3491ab1dd1ebd
Link:
https://www.unpac.me/results/ba6ebacf-b8fc-49bf-9252-71d37f770f38/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 990935b463ede1b4670f2b149a6100ffbc52da7796977083cfff085c993029f6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3632353/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/29147/

Comments