MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Worm.Virut


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0
SHA3-384 hash: 30f6c1dd9c93ea5668906f5e3ff463b008630f3c4509f91797fe3f7780d05e537f2ba9c2170fd7cade410ffdfffb7d40
SHA1 hash: 41fb758b60023a7c3ddfeca287347b969f535588
MD5 hash: e26d904e5e4d75235a47e92375c928b7
humanhash: two-louisiana-carpet-kentucky
File name:9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0
Download: download sample
Signature Worm.Virut
Create hunting rule
File size:295'316 bytes
First seen:2026-04-01 10:27:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1bc8a8ab15f37dfcacba988951c15280 (1 x Worm.Virut)
ssdeep 6144:9fnkgN3hEeHkfeQZwX5uHMKT9qrVUTiR0gzyTVeN57tmZ3qY:VxNXHMeXkHVC6tZevJmZaY
Threatray 2'143 similar samples on MalwareBazaar
TLSH T1D454D3087F48E837F80E827AFF21CF568D6D54199D9840EE76B0BC8D18D99CA3D25939
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 71e0b088ecd6e071 (1 x Worm.Virut)
Reporter JAMESWT_WT
Tags:exe miappl-com Worm.Virut

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
IT IT
Vendor Threat Intelligence
Gathering data
Malware family:
n/a
ID:
1
File name:
9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0
Verdict:
Malicious activity
Analysis date:
2026-04-01 10:28:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4f87aead-69d6-4609-bd0f-47b48b946831

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/60031/
Detection(s):
Win.Trojan.Ramnit-1849
Create hunting rule

Win.Trojan.Ramnit-1847
Create hunting rule

Win.Packed.Esfury-7649595-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ccf3403a18a6e1ddf046a8
Tags:
ramnit emotet virut
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug fingerprint installer-heuristic microsoft_visual_cc nimnul overlay overlay packed packed ramnit spyeye virus virut zbot
Link:
https://www.filescan.io/uploads/69ccf33de2df9aa488c1e6ae/reports/f58e5bb2-b425-42d0-b805-541135c246a1/overview
Verdict:
Malicious
Labled as:
Virus.Nimnul
Link:
https://www.hybrid-analysis.com/sample/9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0
Verdict:
Malicious
File Type:
exe x32
First seen:
2015-02-19T04:30:00Z UTC
Last seen:
2026-04-02T21:25:00Z UTC
Hits:
~10
Detections:
Virus.Win32.Virut.sb Virus.Win32.Virut.ce Virus.Win32.Nimnul.a Trojan.Win32.Inject.sb Trojan.Win32.Agent.sb HEUR:Virus.Win32.Generic HEUR:Trojan.Win32.Generic UDS:DangerousObject.Multi.Generic
Link:
https://opentip.kaspersky.com/9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eb3e4e1f-450f-45cb-ac50-c7605955cac7
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/e26d904e5e4d75235a47e92375c928b7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0/
Verdict:
Malicious
Threat:
Virus.Win32.Virut
Link:
https://tip.neiki.dev/file/9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0
Threat name:
Win32.Worm.Ramnit
Create hunting rule
Status:
Malicious
First seen:
2015-02-19 02:51:00 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
35 of 36 (97.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t3xaxuhubsqrmdlolnrtdr5ho4qkhgvl4wl3yxtxpozgrklftlya._file
Verdict:
malicious
Label(s):
unc_loader_093
Create hunting rule
Similar samples:
240ed9d0ec651922abf24d244966dc99c5ae7ab0727e1df686e8e2ee02da75ce
Worm.Virut
4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123
Worm.Virut
579b18d7831f7846faef5e226dba5b09f9ddb6d3f2b6cc551dac0260b9aca44e
Worm.Virut
68e3e2f48ad958944adce26dd4ade41d52120380787a9bddfde6223d12d3f0dd
Worm.Virut
68f9c7084a93f5b0487210704343acb69339b5bd16921cf1dae0c20966911df0
Worm.Virut
9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0
Worm.Virut
b26bcb5c60a74d1b5f8158ae9bf3236493c57c7d00773a51e35cc2131cd613f5
Worm.Virut
ca5a85e1bdb053179686c9c35a9bf00d762acb201efd3826299a520d39961fbf
Worm.Virut
de29abf7c7a7916fc08684491f12fed163fa31f1e492d49f4422a451158fb98b
Worm.Virut
error
Worm.Virut
+ 2'133 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery
Link:
https://tria.ge/reports/260401-mhrwhsbv3r/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Executes dropped EXE
Modifies firewall policy service
Unpacked files
SH256 hash:
9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0
MD5 hash:
e26d904e5e4d75235a47e92375c928b7
SHA1 hash:
41fb758b60023a7c3ddfeca287347b969f535588
Link:
https://www.unpac.me/results/c77fa532-f099-49e1-8253-0b6b9c2dc03a/
SH256 hash:
6d1b05f7b7622c8067eb5120c4a9027160df114ff5488162bea2527df42143ed
MD5 hash:
4253942959b4fd8d51374acfcf6d0950
SHA1 hash:
87a7f01550dc46a7ad48e2b1bd09e3243e12391b
Link:
https://www.unpac.me/results/c77fa532-f099-49e1-8253-0b6b9c2dc03a/
Malware family:
Virut
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9eee0bd0f40c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9eee0bd0f40ca1160d6e5b6331c7a77720a39aabe597bc5e777bb268a9659af0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/60031/

Comments