MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574
SHA3-384 hash: 6c742297ca64486217111ddebf2e0bb9e79c49ec92eb171783e4f6bce0c4f49b62b1d9ea159cb15a08c8caf24645479a
SHA1 hash: 6adbf0f6c074b9d74e40b20fec00cd4acb88ae47
MD5 hash: 27bb839db93a5ffefa949415ed7ff4cd
humanhash: missouri-lion-helium-comet
File name:setup.exe
Download: download sample
File size:6'976'512 bytes
First seen:2026-05-15 00:44:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 94439b5cb38d5f14fd65eb5e1da5059d
ssdeep 196608:aa04SCC6YeWZQM7hr0GVJ6kgaaoPx6Kfbt8:aaxa6YeWZP7hIa6kXayz8
TLSH T147660112BB40D062E55701B4751DE7A65078BA30466A8883F7C4BF1FB9B0BD2EA39F47
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter aachum
Tags:Adware.Neoreklami dropped-by-Adware.DownloadAssistant exe


Avatar
iamaachum
http://194.87.138.68/a/setup.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
http://cloudsaze.com/file/16019d0
Verdict:
Malicious activity
Analysis date:
2026-05-14 16:34:09 UTC
Tags:
downloadassistant adware stealer remus inno installer delphi neoreklami loader golang raccoonclipper
Link:
https://app.any.run/tasks/6b14d6bb-7e16-4add-b1a2-99002f0baf5e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/65965/
Detection(s):
Win.Trojan.Generic-9934730-0
Create hunting rule

PUA.Win.Adware.Neoreklami-9785359-0
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a066c72953bbcef1c9068ea
Tags:
malware
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug fingerprint microsoft_visual_cc packed reconnaissance
Link:
https://www.filescan.io/uploads/6a066c6e2fcb905ec2990e14/reports/92012c65-c818-4404-ba55-d1b6960e9bd0/overview
Verdict:
Malicious
Labled as:
Adware.Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574
Verdict:
Adware
File Type:
PE
First seen:
2026-05-14T21:58:00Z UTC
Last seen:
2026-05-16T19:32:00Z UTC
Hits:
~10
Detections:
not-a-virus:HEUR:AdWare.Win32.Neoreklami.pef not-a-virus:AdWare.Win32.Neoreklami.sb
Link:
https://opentip.kaspersky.com/a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/2a08c0c7-1d17-4c29-9a15-85963f0a0f17
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1913819
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/27bb839db93a5ffefa949415ed7ff4cd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574/
Verdict:
Malicious
Threat:
AdWare.Win32.Neoreklami
Link:
https://tip.neiki.dev/file/a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574
Threat name:
Win32.Adware.Neoreklami
Create hunting rule
Status:
Malicious
First seen:
2026-05-15 00:45:50 UTC
File Type:
PE (Exe)
AV detection:
17 of 24 (70.83%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=umbq3kakuxyni2lpi6xkv5hdfccpdnnn3qaqf3qakcto72wjmv2a._file
Gathering data
Unpacked files
SH256 hash:
a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574
MD5 hash:
27bb839db93a5ffefa949415ed7ff4cd
SHA1 hash:
6adbf0f6c074b9d74e40b20fec00cd4acb88ae47
Link:
https://www.unpac.me/results/d1cb1d27-7a49-4d45-8bfe-b6a3d224c60b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe a3030da80aa5f0d4696f47aeaaf4e32884f1b5addc0102ee0050a6efeac96574

(this sample)

  
Dropped by
Adware.DownloadAssistant
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/65965/

Comments