🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4
SHA3-384 hash: 728d90bfb1e1cd7807fb21cd1cbe66c99dc5ae15f0bb200bd07f2bb4ea097287ea1009668eacde2c9e258e2f11e07096
SHA1 hash: 5a5f0918083f8946de1fb6731a08318881adbb0a
MD5 hash: 5dddaa4be7d145181700238e9734ea5a
humanhash: alpha-butter-oscar-washington
File name:a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4
Download: download sample
File size:1'152'512 bytes
First seen:2026-11-09 07:53:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'364 x AgentTesla, 20'869 x Formbook, 12'418 x SnakeKeylogger)
ssdeep 24576:7jkGarN9COK3/6MSYLnABRgkbJ1m3MZJz6AsYrYNM6:EGarNnK3wY83JI8Pz6RYr
TLSH T19E3502292BD45564E5BE4B38857501604BF2F8178223EB2E6A9C41FC6E327C2DA37377
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
Ihracat viruslu.rar
Verdict:
No threats detected
Analysis date:
2026-10-07 07:00:47 UTC
Tags:
arch-exec netreactor
Link:
https://app.any.run/tasks/e64f2121-decc-4895-96cf-0b0bcf2ac4db

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/98160/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1c2faac89c90fc65a8d9c
Tags:
virus micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-06T02:33:00Z UTC
Last seen:
2026-11-04T19:27:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/912f1911-69a4-4498-8e61-576f554eaec1
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/2002901
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Yara detected MSIL Injector
Behaviour
Behavior Graph:
Download SVG
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86
Link:
https://app.malva.re/file/5dddaa4be7d145181700238e9734ea5a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4/
Threat name:
ByteCode-MSIL.Trojan.AdvML
Create hunting rule
Status:
Malicious
First seen:
2026-10-06 11:18:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
29
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uth3fcfjx46x5pbaq3td7vjshflcqftod75nzf42abz2fw32v62a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/261109-jrs86axzet/
Behaviour
System Location Discovery: System Language Discovery
.NET Reactor proctector
Malware Family:
n/a
Verdict:
Benign
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b1ac27f7-c3c9-4b6a-a243-53c7e22d08ef
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
polymorphic dotnet peexe debugger-check exec-delay
Link:
https://intel.virussign.com/intelligence/file/a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4
Unpacked files
SH256 hash:
a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4
MD5 hash:
5dddaa4be7d145181700238e9734ea5a
SHA1 hash:
5a5f0918083f8946de1fb6731a08318881adbb0a
Link:
https://www.unpac.me/results/b32da9d6-138a-4f8b-81c4-dafd0d9ac541/
SH256 hash:
5de394df999f68f456bb667084cece6350d6100fd9b59279fe4a9507d2c89076
MD5 hash:
5593d332ef719bb437d2f9a1c7284964
SHA1 hash:
6647c218c26c7d526db1fa5051e611e9d5b054f9
Detections:
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b32da9d6-138a-4f8b-81c4-dafd0d9ac541/
Parent samples :
d6ff19d64c633bdbb85f7bdef972469d5fabf1e883fb21d13393765a9b741330
01d748f8fe167e13355ba570eacad9d6aea8e9df6d429c4e420354a9d2372c6b
dbc065b70b31021861dd5a62e9127e098a691027467516cbef867b4922c3647c
5d8908031799744f9a338728d759cb97849a8f6aa70048eb6654b41318b678d9
f5dc09d7de3886adf414d3d30a1f46545735cf009f7a4668a17140328976d311
a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4
a7dccc6132ec44a6e0fcf7b754a95a9264c8dceead99e59c534a00d785f7cea8
48072e7cf89702185b17f20400879d5d903d514296972b0c80758a4e46d8752c
59b744bbecfe7b6754f1fe56bced32bc3e6137f5ed862c6f51472a521e170c73
9b9b70f87e0c4cd60cb255ca914f5f5ddcaac7e0fbe9b266034021a555d48769
1891ee3368fdbe89c4c9dfec43d68b2fe0e87025e4bb7416928f87b4a3e6a6a0
4e5ecfc6cd4e24870eb4dac4e49c8ef6f626245a15649ddfb7f7e0307e735305
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4cfb288a9bf3d7ebc2086e63fd532395628166e1ffadc979a0073a2db7aafb4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98160/

Comments