MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93
SHA3-384 hash: 31a14ec0ca373c3b9613218d5a2ab2e9f90165c317f670b589de5b14045b28f5a83139a7616bf47b03a8ff733ac4f9c4
SHA1 hash: f3bebc66701cdb3088e7d43a99b10a7d0a7e9f6c
MD5 hash: b7cb33dcc5cde29a075525a880362e56
humanhash: single-cola-quebec-illinois
File name:Launcher.exe
Download: download sample
File size:24'432 bytes
First seen:2026-07-11 12:29:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'120 x AgentTesla, 20'127 x Formbook, 12'359 x SnakeKeylogger)
ssdeep 384:86gVSL7jj+wmjjturFnOinkuDZxHafHJqsW76PthUuq4SDZp5KmMwUaym/B99R:VBj+dtkznkUUpqhytuOSlpIRwLyKj
TLSH T1ABB25C936FFC0162FAFE4F3098F205432E76BFC72862D26F9840504E4AA67A15D11B79
TrID 69.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win64 Executable (generic) (6522/11/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter SquiblydooBlog
Tags:exe signed

Code Signing Certificate

Organisation:Avento Software OU
Issuer:SSL.com Code Signing Intermediate CA RSA R1
Algorithm:sha256WithRSAEncryption
Valid from:2026-07-06T10:58:03Z
Valid to:2027-07-06T10:58:03Z
Serial number: 3a33265796f807181e9fdd677afe786a
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 675df1ab04460de16b19e940ce63eb78798b876e990fbaf0d6c5de41f78cd401
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
https://streamzyra.live/
Verdict:
Malicious activity
Analysis date:
2026-07-11 12:08:41 UTC
Tags:
loader
Link:
https://app.any.run/tasks/9326afe5-90ae-49ed-8672-bab2c26ddb3c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74256/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a52372d13f68731ed6ba028
Tags:
injection obfusc micro
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
dotnet fingerprint lolbin signed
Link:
https://www.filescan.io/uploads/6a523727432049cc0a669b32/reports/fd5dfdc0-49de-4a2d-9143-3ac2ebad3b7c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93
Verdict:
Clean
File Type:
exe x32
Link:
https://opentip.kaspersky.com/9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1b5ca197-7597-4f77-bfc7-5512e48e5723
Score:
2%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.28 Win 32 Exe x86
Link:
https://app.malva.re/file/b7cb33dcc5cde29a075525a880362e56
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tzdcssvapnc6gcc2iy7sxd3gyhdliswvcscwtibu3tdaqkzrzwjq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/260711-pn445saw2k/
Unpacked files
SH256 hash:
9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93
MD5 hash:
b7cb33dcc5cde29a075525a880362e56
SHA1 hash:
f3bebc66701cdb3088e7d43a99b10a7d0a7e9f6c
Link:
https://www.unpac.me/results/e99515a0-4cd1-4409-9534-31e00db5cf74/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/74256/

Comments