MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a05a7503337290e90c16dd35461d97aad4e64345d2330e04172e905dde83369c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a05a7503337290e90c16dd35461d97aad4e64345d2330e04172e905dde83369c
SHA3-384 hash: 34aecdedab90ef52bbc7109d3a4d4013bf2f7bf33984606eac77fb71ed0225d4d08eeb8c8f5fb32922e038a8a56017c2
SHA1 hash: b520094b2ac5faf37b88fe0b81a7007addb3db21
MD5 hash: aa6804bd3237a3c1bac03a931826a19a
humanhash: purple-mountain-three-alaska
File name:libfzclient-commonui-private-3-69-5.dll
Download: download sample
File size:5'492'736 bytes
First seen:2025-12-30 09:50:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5046b85e2ab9a59b139a3602e5eee73a (1 x AsyncRAT)
ssdeep 98304:OeqUVrEn0vPokb7j0agwm38I62VW+g7nND2i9imR2O5Stjgq0ga1IeEFNtw6uPLu:PqUVrLJb8aQ3zjWFNCckO5Stc8SsFNeR
TLSH T12246BF87B3C46E99C005CD3A6717FE319193A9A38A7690C96F96D70A4EF5B113F38B40
TrID 66.6% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10522/11/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:2bknb-com 2vbkb-com Aotera avrfd-com booking exe vrfdns-com

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
libfzclient-commonui-private-3-69-5.dll
Verdict:
No threats detected
Analysis date:
2025-12-30 12:03:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5e658ad5-492c-4edb-89ce-9a3109aa786d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46534/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6953a09a7d915bf1778eeb61
Tags:
emotet virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypto masquerade microsoft_visual_cc overlay
Link:
https://www.filescan.io/uploads/6953a09209f6942c4fc64a83/reports/2b6f717a-3baf-47e0-88fb-74b07e8ae357/overview
Verdict:
Malicious
Labled as:
HEUR_Trojan_Win32_Generic
Link:
https://www.hybrid-analysis.com/sample/a05a7503337290e90c16dd35461d97aad4e64345d2330e04172e905dde83369c
Verdict:
Malicious
File Type:
dll x64
First seen:
2025-12-29T05:06:00Z UTC
Last seen:
2025-12-29T05:59:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a05a7503337290e90c16dd35461d97aad4e64345d2330e04172e905dde83369c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6dde299c-9cdc-423e-a6fd-3373271e8075
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a05a7503337290e90c16dd35461d97aad4e64345d2330e04172e905dde83369c
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/aa6804bd3237a3c1bac03a931826a19a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a05a7503337290e90c16dd35461d97aad4e64345d2330e04172e905dde83369c/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-29 10:07:43 UTC
File Type:
PE+ (Dll)
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ubnhkaztokiosdaw3u2umhmxvlkomq2f2izq4baxf2if3xudg2oa._file
Gathering data
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/834e5cc0-7278-4544-98db-b93c607c93af
Unpacked files
SH256 hash:
a05a7503337290e90c16dd35461d97aad4e64345d2330e04172e905dde83369c
MD5 hash:
aa6804bd3237a3c1bac03a931826a19a
SHA1 hash:
b520094b2ac5faf37b88fe0b81a7007addb3db21
Link:
https://www.unpac.me/results/980c8905-9302-416e-9653-cef2f60960f3/
Malware family:
DCRat
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a05a75033372/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a05a7503337290e90c16dd35461d97aad4e64345d2330e04172e905dde83369c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/46534/

Comments