MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Intelligence 12 IOCs YARA 6 File information Comments

SHA256 hash:	a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e
SHA3-384 hash:	ec2749acf48932824c07b57894c5fd67e97194865862e9b27f6ea817d7b33ef3f7852967bdfc47e7f09a0d1fb3710064
SHA1 hash:	eb421be214c42a6ce979c16064764151822122c8
MD5 hash:	d8a498d3ed32fa33ff9c2e1a20e984da
humanhash:	may-freddie-robin-earth
File name:	a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e
Download:	download sample
File size:	503'360 bytes
First seen:	2025-09-27 18:42:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:utU1ZCuK1q6ZvFIAwh9G6AmDG4lMpu9JL:utU1ZzS6fG43
TLSH	T1D6B45C362096FA8FF5290D7B8540B475DCB8BD13A735D4C87F8A3609A1BBA44CFA14B4
TrID	40.9% (.EXE) Win64 Executable (generic) (10522/11/4) 19.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.0% (.EXE) Win16/32 Executable Delphi generic (2072/23) 8.0% (.ICL) Windows Icons Library (generic) (2059/9) 7.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	73e8ccd6d6cce873
Reporter	WhichbufferArda
Tags:	APT44 backdoor exe kalambur Sandworm signed

Code Signing Certificate

Organisation:	ESET North America
Issuer:	ESET North America
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-06-06T10:50:42Z
Valid to:	2027-09-09T10:50:42Z
Serial number:	504c1240eba06b3cb7b3a599e9d91696eda099a4
Thumbprint Algorithm:	SHA256
Thumbprint:	a7046315fea8491435a9f8e4d3d6fbd8353ab2370aa6c0bdc62d92152401792f
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

WhichbufferArda

June 2025, KALAMBUR backdoor. Delivered with Signal Messenger.

Intelligence

File Origin

# of uploads :

# of downloads :

254

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e

Verdict:

Malicious activity

Analysis date:

2025-09-27 18:43:48 UTC

Tags:

api-base64 ms-smartcard github auto-sch ssh susp-lnk susp-powershell

Link:

https://app.any.run/tasks/6916f019-951e-4e92-b2fa-1f7e90ed3ea9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/29291/

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68d82e0afb8bc5050e4f1d3d

Tags:

ransomware virus sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Adding a root certificate

Creating a process from a recently created file

Creating a window

Launching a process

Creating a process with a hidden window

Launching the process to interact with network services

Сreating synchronization primitives

Launching a service

DNS request

Connection attempt

Sending a custom TCP request

Loading a system driver

Launching the process to change the firewall settings

Searching for synchronization primitives

Using the Windows Management Instrumentation requests

Creating a file in the system32 subdirectories

Modifying a system file

Moving a recently created file

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Enabling autorun for a service

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 dropper fingerprint icacls invalid-signature lolbin msiexec net netsh obfuscated overlay packed persistence powershell ps2exe reg sc schtasks self-signed-cert signed stealer

Link:

https://www.filescan.io/uploads/68d83058674d5fd6aa0e7ea1/reports/cc36dcfd-69f6-4c35-9227-d0924d80991e/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-06-18T11:54:00Z UTC

Last seen:

2025-06-18T11:54:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/160043ea-1655-4b33-8bf8-2f4356bbe236

Score:

92%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e

Verdict:

Malware

YARA:

7 match(es)

Tags:

.Net Base64 Block Base64 Payload Batch Command Contains Base64 Block DeObfuscated Executable Managed .NET PE (Portable Executable) PE File Layout PowerShell PowerShell Call SOS: 0.35 Win 64 Exe WScript.Shell x64

Link:

https://app.malva.re/file/d8a498d3ed32fa33ff9c2e1a20e984da

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e/

Threat name:

ByteCode-MSIL.Trojan.GlueShot

Status:

Malicious

First seen:

2025-06-18 17:45:39 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

21 of 36 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ug2b67ximlxjoa5p3j3zhurhfdspr6sxcjavec4x2uryoxmbgm7a._file

Result

Malware family:

n/a

Score:

8/10

Tags:

defense_evasion discovery execution persistence privilege_escalation spyware trojan

Link:

https://tria.ge/reports/250927-xc6gtsxzdt/

Behaviour

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

Runs net.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Modifies trusted root certificate store through registry

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Modifies visibility of existing users in the login screen

Badlisted process makes network request

Modifies Windows Firewall

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/cee8d64e-af58-4cfa-8ef3-b802e31e4a44

Unpacked files

SH256 hash:

a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e

MD5 hash:

d8a498d3ed32fa33ff9c2e1a20e984da

SHA1 hash:

eb421be214c42a6ce979c16064764151822122c8

Link:

https://www.unpac.me/results/2450e4e4-5af0-4bb9-8d36-c5a4fe48d14d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)