MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 13

Intelligence 13 IOCs YARA 4 File information Comments

SHA256 hash:	a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637
SHA3-384 hash:	632ce3f6a9325eb59ea1dfd5dccbcfe71e794e794bba11b54ff44c999649fb4e18bd5260d55f6d1354bfef7167acae8e
SHA1 hash:	a591eda7d3ec0099c80a18a139348e16847ae2ac
MD5 hash:	8c1ca7398246703c6df6ff1f5f3c2afa
humanhash:	delta-winner-connecticut-oregon
File name:	uks.exe
Download:	download sample
File size:	494'640 bytes
First seen:	2026-08-11 08:40:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9be4f90f50c714bc00cc8beb2e137299 (7 x RemcosRAT, 6 x Formbook, 2 x ValleyRAT)
ssdeep	12288:qLiUZG8a8WoSODfsYFu6SlICntgp6S3S+pkF:qxZG8a8tXVkICtb8KF
TLSH	T1B8B40100EE8258ECD07A877059B75A5320337DEC5C75F11F9A58B7BB7F729818A3A206
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	01955593786f9b03
Reporter	abuse_ch
Tags:	exe signed

Code Signing Certificate

Organisation:	Ekspanderer
Issuer:	Ekspanderer
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-06-11T03:41:27Z
Valid to:	2027-06-11T03:41:27Z
Serial number:	219ca8ed9938ce76795ca8ee7f458f59b9b7da63
Thumbprint Algorithm:	SHA256
Thumbprint:	ffd5feaac84ac0fa0fda383cbb8cab4c8105605c4db376917fc04f205e829114
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

136

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NSIS

Details

Link:

https://research.acce.ciphertechsolutions.com/results/6fc4b564-d071-41eb-9d70-e30386dd7748/

Malware family:

xmrig

ID:

File name:

bomb.exe

Verdict:

Malicious activity

Analysis date:

2026-08-11 14:59:42 UTC

Tags:

ip-check possible-phishing xmrig miner github loader phorpiex botnet auto generic pikabot stealer stealc nemucod evasion discord formbook amadey sliver framework xworm remote rat screenconnect solaris phantom clipper diamotrix connectwise rmm-tool telegram remus quasar rdp tool ftp susp-powershell powershell remcos uac-bypass zigcryptostealer loda backdoor webshell inj3ctor3 jomangy fakesite phishing agenttesla winring0-sys vuln-driver maskgramstealer dcrat darkcrystal sheetrat njrat themida apt blindeagle vidar python netreactor redosdru etherhiding websocket advancedinstaller hijackloader stego reverseloader remusstealer adware payload asyncrat bladabindi gcleaner pastebin qatarrat kimsuky coinminer

Link:

https://app.any.run/tasks/138bae21-bd9d-4c24-af4d-a6649192fb89

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/80261/

Detection(s):

YARA.SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac1d7277521726fe3d74e41

Tags:

injection obfusc virus nsis

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Delayed reading of the file

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

installer installer nsis signed

Link:

https://www.filescan.io/uploads/6a7ae0351d37c59ea197614b/reports/3eb6c9d3-2a12-4173-a7b8-47360ff13e32/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-29T03:10:00Z UTC

Last seen:

2026-08-12T12:04:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637/results?tab=lookup

Malware family:

Unlabeled

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/cb7b1a1a-37c2-4cf3-af4c-dc595a2446e9

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1955737

Signature

AI detected suspicious PE / MSI digital signature

Antivirus / Scanner detection for submitted sample

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

Unusual module load detection (module proxying)

Behaviour

Behavior Graph:

Download SVG

Score:

70%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/8c1ca7398246703c6df6ff1f5f3c2afa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637/

Threat name:

Win64.Trojan.Malgent

Status:

Malicious

First seen:

2026-07-29 06:17:46 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=upzd3x6t3ucyuh3a3wsqvvnaryyveikivr3ttrg7hm5utdwoiy3q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/260811-klghvav1dy/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates physical storage devices

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

Unpacked files

SH256 hash:

a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637

MD5 hash:

8c1ca7398246703c6df6ff1f5f3c2afa

SHA1 hash:

a591eda7d3ec0099c80a18a139348e16847ae2ac

Link:

https://www.unpac.me/results/632082f9-0b46-45c9-bc78-6ffade0d396d/

SH256 hash:

29379ece432ccb81e22e57d7b5a8a77951c985495a931827f01771cf60b8b438

MD5 hash:

9b3a5adad3c54468b976f683ef28aae4

SHA1 hash:

e6ce3ed9fa51474ca560c41075be8cd52ae81e46

Link:

https://www.unpac.me/results/632082f9-0b46-45c9-bc78-6ffade0d396d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	SUSP_NullSoftInst_Combo_Oct20_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious NullSoft Installer combination with common Copyright strings
Reference:	https://twitter.com/malwrhunterteam/status/1313023627177193472

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.