MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e2d984c2ea8a589919bce7492c5a093d589a062fe13cdb1f1497902cf324dfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e2d984c2ea8a589919bce7492c5a093d589a062fe13cdb1f1497902cf324dfe
SHA3-384 hash: 129f24f0d4082d61f5a492edfa51fe992063c69cd6cfb6a7ab7e3832e2334f635843b2b50a6f1796e0f8ce35c5114c6e
SHA1 hash: 3167e0abfad23a47fd3885970314818137ac08ad
MD5 hash: abc1a4bf260971113464d7fe5b6190e5
humanhash: sodium-steak-avocado-mississippi
File name:SecuriteInfo.com.Win64.Evo-gen.24351261
Download: download sample
File size:2'541'792 bytes
First seen:2025-11-29 06:36:40 UTC
Last seen:2025-11-29 07:23:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d42595b695fc008ef2c56aabd8efd68e (92 x Rhadamanthys, 83 x Vidar, 43 x LummaStealer)
ssdeep 24576:jA5xDNPlkBEFhtDhoUFo91x0Z1jJ/5Wj4ElO9LWdbbVkGnWRDL/j15BZ+rVi2:jArNPlNhtDvKiZ1NkjFh+DP6Vd
Threatray 10 similar samples on MalwareBazaar
TLSH T155C56D57FC9219A7C0AAA231896661827B71BC153F3223DB2E50B37C3F72BD05A79711
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win64.Evo-gen.24351261
Verdict:
Malicious activity
Analysis date:
2025-11-29 06:40:05 UTC
Tags:
havoc backdoor framework
Link:
https://app.any.run/tasks/65aaa79e-a04c-47ac-8114-59df2bbdb635

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/41804/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692a94ad6cb1dcd577824793
Tags:
injection obfusc crypt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending an HTTP POST request
DNS request
Verdict:
Malicious
Labled as:
Trojan.Scars.Marte.D.Generic
Link:
https://www.hybrid-analysis.com/sample/9e2d984c2ea8a589919bce7492c5a093d589a062fe13cdb1f1497902cf324dfe
Result
Gathering data
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-11-29T03:04:00Z UTC
Last seen:
2025-11-29T03:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9e2d984c2ea8a589919bce7492c5a093d589a062fe13cdb1f1497902cf324dfe/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a83929f8-687a-459f-8d75-1efc09ee3a5f
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9e2d984c2ea8a589919bce7492c5a093d589a062fe13cdb1f1497902cf324dfe
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/abc1a4bf260971113464d7fe5b6190e5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e2d984c2ea8a589919bce7492c5a093d589a062fe13cdb1f1497902cf324dfe/
Threat name:
Win64.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2025-11-29 05:20:06 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
18 of 36 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tywzqtbovcsytem3zz2jfrnaspkytidc7yj43mprjf4qftzsjx7a._file
Verdict:
malicious
Label(s):
havoc
Create hunting rule
Similar samples:
0fcfd0d96f6a07a100e1889a9155a16250995c623a04d20a38b5448e1352d1ad
1c90bf627974304daff3ecc3431ab612e295a2775b445e35d885acac4c9185a7
7bd0979b956900df4b7bb438caf3b3c64257d470f1ab93df680ab0de58ead80f
b9c6a448c486cde5a856e6f4c7c74f46bede0f1249db139a0c7b27c9f71c52cc
error
f1b1e66de0451e6a9f53afdf2dfbf86be1bc9d520a67a43cfce4a6d4f805a9cb
Result
Malware family:
havoc
Create hunting rule
Score:
  10/10
Tags:
family:havoc backdoor
Link:
https://tria.ge/reports/251129-hdnabawlhp/
Behaviour
Detects Havoc payload
Havoc family
Havoc, HavocC2
Unpacked files
SH256 hash:
9e2d984c2ea8a589919bce7492c5a093d589a062fe13cdb1f1497902cf324dfe
MD5 hash:
abc1a4bf260971113464d7fe5b6190e5
SHA1 hash:
3167e0abfad23a47fd3885970314818137ac08ad
Link:
https://www.unpac.me/results/c1e44f19-939e-4154-a8d0-4b3a98c0cfdc/
Malware family:
Havoc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9e2d984c2ea8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 9e2d984c2ea8a589919bce7492c5a093d589a062fe13cdb1f1497902cf324dfe

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3719376/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/41804/

Comments