MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a6848f56649bb89b54675a05f0a875a5a8c4b57af690288eacfd8b4d4ffeecd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | a6848f56649bb89b54675a05f0a875a5a8c4b57af690288eacfd8b4d4ffeecd2 |
|---|---|
| SHA3-384 hash: | 4f954b473bdeaab217b1934d9fb8f814ae5fe051bc32ac256d9a60cc55bb3230bced3c62c5b1bb5502c8d4cd69163f1b |
| SHA1 hash: | 2e2bbaf2b0ca6770b7a10532563145302cad6361 |
| MD5 hash: | 1bc3399110eb64d1f7db3427e08e5bb4 |
| humanhash: | coffee-two-india-blue |
| File name: | a6848f56649bb89b54675a05f0a875a5a8c4b57af690288eacfd8b4d4ffeecd2.exe |
| Download: | download sample |
| File size: | 2'573'954 bytes |
| First seen: | 2026-10-01 08:17:48 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f4d1e4cd7416ef83f79f7c6a038875b3 (2 x ConnectWise, 2 x ValleyRAT) |
| ssdeep | 49152:4aVPF+nFa6OnZ0nupoKDoLxCNSNWNyfgneIgF/g3GMMxUwu:T4M6OZJoKELTNWNyoK/gWg |
| TLSH | T1DAC5334DF7364CF5EEF441B08C8BD94B8B325D22861A9A4987697673EC33491E20F798 |
| TrID | 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | c4dadadad2f492c2 (149 x GuLoader, 55 x RemcosRAT, 23 x VIPKeylogger) |
| Reporter |  whack_sh |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
180
Origin country :
USVendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-01 08:20:12 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
70%
Tags:
injection
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a window
Сreating synchronization primitives
Gathering data
Verdict:
Unknown
File Type:
exe x32
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
clean
Classification:
mine
Score:
15 / 100
Signature
Found strings related to Crypto-Mining
Behaviour
Behavior Graph:
n/a
Score:
91%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
defense_evasion discovery trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks installed software on the system
Loads dropped DLL
Unpacked files
SH256 hash:
a6848f56649bb89b54675a05f0a875a5a8c4b57af690288eacfd8b4d4ffeecd2
MD5 hash:
1bc3399110eb64d1f7db3427e08e5bb4
SHA1 hash:
2e2bbaf2b0ca6770b7a10532563145302cad6361
SH256 hash:
dd8f3266191a0cac1822eaeea400a6b87f9e461b853f3524042039764fe41e8c
MD5 hash:
bbff690f9c58e18e23296bfd7dbb1677
SHA1 hash:
8b32960eeadec46933c486f8efa807d9e427c8cc
SH256 hash:
0cee4c182ea92b2e7bce942db990e5bd88ab6f8927704209817d04cfab25cf1f
MD5 hash:
94bed44c269786f8f99db87819171975
SHA1 hash:
6f29a1b26d31d49037a4fca2e704f5cafef97423
SH256 hash:
5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 hash:
948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 hash:
75197fee3c6a814fe035788d1c34ead39349b860
SH256 hash:
1a3b738901baf1c82b37c7ee683cc31f2fabb518941eb876e3ef2257ff49653b
MD5 hash:
fe336b0f31a4353a7956058ebccffe5c
SHA1 hash:
99bc776ca80f436844603df1f9412924b9ffb626
SH256 hash:
dfa02ad29e171ba94e2ed1cf67fb125d4b976bfe6ef2258fc2666d811c7e7ff0
MD5 hash:
603fc3c0741ebb52d480e254bfe725b9
SHA1 hash:
b09a8a1fe852832ce14c9c1970e257794b4fafa0
SH256 hash:
54167ae0968e05910ef8dcd8bbc345afe3dad810fd3c9d2d3f47ad4caffc456d
MD5 hash:
4fd5a2cd0c65c6552fea0cc11938f251
SHA1 hash:
e8f11c1f919eee06f8ebfde989ff53a15243e57f
SH256 hash:
3564ce8b510acfe456f7135e0c1ac1f71cfa39c787909192be8f8ed40dcbe305
MD5 hash:
a396d30099517546b62c0aa673929f93
SHA1 hash:
f3eea24ee7faf86638dfd8c730a544a94716378b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Detect_NSIS_Nullsoft_Installer |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects NSIS installers by .ndata section + NSIS header string |
| Rule name: | Win_Clipboard_Clipper_Thengavar |
|---|---|
| Author: | Thengavar |
| Description: | Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe a6848f56649bb89b54675a05f0a875a5a8c4b57af690288eacfd8b4d4ffeecd2
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.