MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 7 File information Comments

SHA256 hash:	9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3
SHA3-384 hash:	d31f32a29f3e183f56aa562261e903bd5460821a543174e808c2ad355a65b253f972cda8bfe45876dc3f1fc3827606e0
SHA1 hash:	e08f23905e843ae192e468f0c1bb1263eafb7370
MD5 hash:	fb79683d97abd0650e8e1176fe50b6c0
humanhash:	steak-three-mexico-pennsylvania
File name:	higeleveltask_x64.exe
Download:	download sample
File size:	605'696 bytes
First seen:	2026-07-14 12:43:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	92576cbf961890053b0276abaa28bb78
ssdeep	12288:gNH+AxETh1IpJWIf9KvvGQJClDeSF6XKj:gkAqTXCJDWgZ
TLSH	T176D46C19F7A410FEE16BC578C9524916FBB27C4747A0AACF13904A961F2B6E04F3E712
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	skocherhan
Tags:	exe nextjs2385-ngrok-io

skocherhan

https://nextjs2385.ngrok.io/cdn/higeleveltask_x64.exe

Intelligence

File Origin

# of uploads :

# of downloads :

162

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/74616/

Detection(s):

SecuriteInfo.com.FileRepMalware.57147536.UNOFFICIAL

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a562efc56bd89099b553de1

Tags:

abrisk virus

Result

Verdict:

Clean

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug explorer fingerprint lolbin microsoft_visual_cc overlay

Link:

https://www.filescan.io/uploads/6a562ef5d2da39f6d5991577/reports/b6f381a0-ea8e-42da-bbd7-1e490d80fb05/overview

Verdict:

Malicious

Labled as:

Capa_get_geographical_location

Link:

https://www.hybrid-analysis.com/sample/9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-13T20:42:00Z UTC

Last seen:

2026-07-14T12:58:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/48e97df4-8dfd-4c17-90a7-bc124b220d06

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/fb79683d97abd0650e8e1176fe50b6c0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3/

Threat name:

Win64.Packed.Generic

Status:

Suspicious

First seen:

2026-07-14 00:33:46 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

16 of 36 (44.44%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tyivrxxlzlgdakfeqx47qmcguhvbnf2vtm56x7p2bjz24lrkesrq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

persistence

Link:

https://tria.ge/reports/260714-px7lmafx6y/

Behaviour

Uses Task Scheduler COM API

Unpacked files

SH256 hash:

9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3

MD5 hash:

fb79683d97abd0650e8e1176fe50b6c0

SHA1 hash:

e08f23905e843ae192e468f0c1bb1263eafb7370

Link:

https://www.unpac.me/results/6a9e779f-e5c2-44ae-ba4f-4f85da8c5955/

SH256 hash:

30b28360fc1e9fd769c7331d90655dfd7622f6d892e125df6b209842a955ff0d

MD5 hash:

feaac723149044dd6aa96b5f25926155

SHA1 hash:

17ccb4f95db817a20ce6d779281a03cdbca54fd1

Detections:

triage_lockbit_ransomware

Link:

https://www.unpac.me/results/6a9e779f-e5c2-44ae-ba4f-4f85da8c5955/

Parent samples :

9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3
6c4410c4a65762d91109c5ded9e432689f6e274229551fc1cc66059342864477
4a3d1b9df22e50a9556d7161dc36800eb37833eca26057036d34e5be27f4df6d
8db515e787086c6338598c862601d6643c898af8407452679009ab51960eb299
1be1cf9f734a326dab0e909204f981c305923ccb2ea476e8b804f3317a8dffcb

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9e1158deebcacc3028a485f9f83046a1ea1697559b3bebfdfa0a73ae2e2a24a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.