MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 997a64155caf5f6374ae2b6627a80fe4c31dd9102e31c4a2ec8affc84d6dae28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 997a64155caf5f6374ae2b6627a80fe4c31dd9102e31c4a2ec8affc84d6dae28
SHA3-384 hash: ea22110d1d54413617e9edab8d41981ecd8156a1ac57d88a71dc0fc63cd4e883dc69a5040204af893274d83182c9ff11
SHA1 hash: 932c15edddbab04949a61c13175182de6329fb76
MD5 hash: 040eaa58bfef491c9234f396eedffe0c
humanhash: high-whiskey-jupiter-winter
File name:9z7BGnRGpgs8cZv7.exe
Download: download sample
File size:2'920'960 bytes
First seen:2026-08-08 17:36:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f5bec796b7b3c2932293afa8281cdeed
ssdeep 49152:Ki0e6+S41sqzTgFR1qto4BO8gWbQErE6Qn1h4Ngs8jfsY9VolypK/PMYadc/:D0ec41sqziq+4hHQEBuzX9Vol1M
TLSH T126D523A265F66DF4C437C77A8F82F4AEB079778187755E87B2CC68044C23198987A770
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
SE SE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/33793436-bbdb-48d4-9592-0d5f8f66d96f/
Malware family:
xmrig
Create hunting rule
ID:
1
File name:
hgf.zip
Verdict:
Malicious activity
Analysis date:
2026-08-08 02:34:05 UTC
Tags:
auto generic metasploit framework discord python github evasion screenconnect remote stealer stealc solaris loader tool rmm-tool xmrig miner powershell ipfs njrat rat phishing clipper diamotrix nemucod arcticagent massbass asyncrat telegram remcos phorpiex botnet rdp maskgramstealer maskgram clickfix tinynuke rustystealer redosdru adware acr purelogs quasar bladabindi possible-phishing glamour vidar datto formbook ip-check action1rmm pastebin rustdesk autoit cobaltstrike advancedinstaller remusstealer phantom winring0-sys vuln-driver destinystealer susp-script ftp remus gotoresolve salatstealer grandoreiro banker koiloader xworm gh0st guloader coinminer putty redline wannacry ransomware xloader networm amus cryptowall action1 cryptolocker rhadamanthys donutloader pyinstaller etherhiding smoke dcrat reversessh delphi
Link:
https://app.any.run/tasks/7c6e3fa9-a6c7-4631-b351-30048a823b74

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79293/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6a77695c7fce16fded195d62/reports/dc7229b8-5049-499a-9e01-f88315094925/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/997a64155caf5f6374ae2b6627a80fe4c31dd9102e31c4a2ec8affc84d6dae28
Verdict:
Unknown
File Type:
exe x64
First seen:
2026-08-08T10:20:00Z UTC
Last seen:
2026-08-08T10:28:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/997a64155caf5f6374ae2b6627a80fe4c31dd9102e31c4a2ec8affc84d6dae28/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1000f274-fa9d-4ff1-92d7-8d0b63cc12bd
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1954477
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates / moves files in alternative data streams (ADS)
Deletes itself after installation
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Suricata IDS alerts for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1954477 Sample: 9z7BGnRGpgs8cZv7.exe Startdate: 08/08/2026 Architecture: WINDOWS Score: 100 40 polygon.gateway.tenderly.co 2->40 42 polygon-public.nodies.app 2->42 44 2 other IPs or domains 2->44 56 Suricata IDS alerts for network traffic 2->56 58 Antivirus detection for URL or domain 2->58 60 Antivirus / Scanner detection for submitted sample 2->60 62 3 other signatures 2->62 9 9z7BGnRGpgs8cZv7.exe 11 2->9         started        13 UsoClient34ed49.exe 33 2->13         started        signatures3 process4 dnsIp5 32 C:\Users\user\AppData\...\UsoClient34ed49.exe, PE32+ 9->32 dropped 34 C:\...\UsoClient34ed49.exe:Zone.Identifier, ASCII 9->34 dropped 64 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->64 66 Creates / moves files in alternative data streams (ADS) 9->66 68 Uses schtasks.exe or at.exe to add and modify task schedules 9->68 70 Deletes itself after installation 9->70 16 UsoClient34ed49.exe 33 9->16         started        20 schtasks.exe 1 9->20         started        46 polygon.gateway.tenderly.co 35.227.193.242, 443, 49784 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 13->46 72 Found direct / indirect Syscall (likely to bypass EDR) 13->72 22 schtasks.exe 1 13->22         started        file6 signatures7 process8 dnsIp9 36 polygon-public.nodies.app 104.26.4.88, 443, 49781, 49783 CLOUDFLARENET-CloudflareIncUS Canada 16->36 38 polygon-bor-rpc.publicnode.com 172.66.150.162, 443, 49782 CLOUDFLARENET-CloudflareIncUS Canada 16->38 48 Antivirus detection for dropped file 16->48 50 Multi AV Scanner detection for dropped file 16->50 52 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 16->52 54 Found direct / indirect Syscall (likely to bypass EDR) 16->54 24 schtasks.exe 1 16->24         started        26 conhost.exe 20->26         started        28 conhost.exe 22->28         started        signatures10 process11 process12 30 conhost.exe 24->30         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/997a64155caf5f6374ae2b6627a80fe4c31dd9102e31c4a2ec8affc84d6dae28
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/040eaa58bfef491c9234f396eedffe0c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/997a64155caf5f6374ae2b6627a80fe4c31dd9102e31c4a2ec8affc84d6dae28/
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-08 12:18:19 UTC
AV detection:
16 of 38 (42.11%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tf5gifk4v5pwg5fofntcpkap4tbr3wiqfyy4jixmrl74qtlnvyua._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution persistence
Link:
https://tria.ge/reports/260808-v7ge3sv1fw/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Deletes itself
Executes dropped EXE
Unpacked files
SH256 hash:
997a64155caf5f6374ae2b6627a80fe4c31dd9102e31c4a2ec8affc84d6dae28
MD5 hash:
040eaa58bfef491c9234f396eedffe0c
SHA1 hash:
932c15edddbab04949a61c13175182de6329fb76
Link:
https://www.unpac.me/results/bf77cbe8-b3ca-4429-9c17-e613dfa10bf3/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 997a64155caf5f6374ae2b6627a80fe4c31dd9102e31c4a2ec8affc84d6dae28

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3894881/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/79293/

Comments