🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GhostPulse


Vendor detections: 19


Intelligence 19 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504
SHA3-384 hash: b0c81d0cd6cae794c68a3135161d8eaa206a865af0ea9ddfe6a71e0c50fa3a04cf704cedfb3f6596187fd2f2e2af13df
SHA1 hash: b16fec7b72667676d2f46739f70420a1ce4e90f8
MD5 hash: 81d77907c33da994e5ca80dfdc1115f7
humanhash: chicken-ceiling-comet-autumn
File name:JUFPRUJS.exe
Download: download sample
Signature GhostPulse
Create hunting rule
File size:15'724'201 bytes
First seen:2026-05-26 00:28:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b5a014d7eeb4c2042897567e1288a095 (24 x HijackLoader, 23 x GhostPulse, 14 x ValleyRAT)
ssdeep 393216:+pgYJQyuedPuzNL//zGb0JQg4KTARTawLnIBzx4:egaQGA/rxJR5T/o
Threatray 1 similar samples on MalwareBazaar
TLSH T10EF63391B7882571C234D533CF9BEB66503AF21272E58E6755DA2E3E1CE3166B3078C2
TrID 42.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.8% (.EXE) Win64 Executable (generic) (6522/11/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4504/4/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon c292ecd8f2f6fe1c (23 x HijackLoader, 23 x GhostPulse, 12 x Vidar)
Reporter aachum
Tags:5-252-155-72 66-163-113-238 exe GhostPulse HIjackLoader SnappyClient YodaTeam


Avatar
iamaachum
http://5.252.155.72/load/os1/JUFPRUJS.exe

C2: 66.163.113.238
Other IOCs: https://176.9.142.218/

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
vidar
Create hunting rule
ID:
1
File name:
_a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.exe
Verdict:
Malicious activity
Analysis date:
2026-05-26 00:34:20 UTC
Tags:
hijackloader loader delphi evasion openssl tool auto-startup stealer stealc vidar attachments attc-unc
Link:
https://app.any.run/tasks/03a50376-3104-470b-a6bd-db452af1235a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
HijackLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/67913/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a14e9725d76862ef947cfd0
Tags:
vmdetect
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a file in the %AppData% subdirectories
Running batch commands
Launching cmd.exe command interpreter
Launching a process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context fingerprint installer installer installer-heuristic microsoft_visual_cc overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6a15473812da0d249c579855/reports/38cc0db6-d79c-4f9b-b141-0369a9f89dfc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-25T16:19:00Z UTC
Last seen:
2026-05-27T05:45:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Penguish.hlx Trojan-PSW.MSIL.Stealer.sb Trojan-Banker.Win32.ClipBanker.sb Trojan.Win32.Strab.sb Trojan-Downloader.Win64.Agent.eoj Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Greedy.sb HackTool.Multi.AmsiETWPatch.sb Trojan.Win32.Penguish.sb Trojan.Win32.Inject.sb HackTool.KMSAuto.UDP.C&C VHO:Trojan-Downloader.Win64.Agent.gen
Link:
https://opentip.kaspersky.com/a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504/results?tab=lookup
Malware family:
IDAT Loader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/948327b2-9616-4e67-a443-926b59741b93
Result
Threat name:
HijackLoader, SnappyClient, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1918355
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Passes commands via pipe to a shell (likely to bypass AV or HIPS)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected HijackLoader
Yara detected SnappyClient
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1918355 Sample: JUFPRUJS.exe Startdate: 26/05/2026 Architecture: WINDOWS Score: 100 112 updatecheck310.activated.win 2->112 114 yodateamgoodhwnc.com 2->114 116 21 other IPs or domains 2->116 132 Suricata IDS alerts for network traffic 2->132 134 Found malware configuration 2->134 136 Malicious sample detected (through community Yara rule) 2->136 138 9 other signatures 2->138 15 JUFPRUJS.exe 13 2->15         started        signatures3 process4 file5 104 C:\Users\user\AppData\Local\Temp\vcl120.bpl, PE32 15->104 dropped 106 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 15->106 dropped 108 C:\Users\user\AppData\Local\Temp\rtl120.bpl, PE32 15->108 dropped 110 6 other malicious files 15->110 dropped 18 DeltaGen32.exe 12 15->18         started        process6 file7 80 C:\ProgramData\prorunner_32\vcl120.bpl, PE32 18->80 dropped 82 C:\ProgramData\prorunner_32\ucrtbase.dll, PE32 18->82 dropped 84 C:\ProgramData\prorunner_32\rtl120.bpl, PE32 18->84 dropped 86 6 other malicious files 18->86 dropped 140 Switches to a custom stack to bypass stack traces 18->140 142 Found direct / indirect Syscall (likely to bypass EDR) 18->142 22 DeltaGen32.exe 28 18->22         started        signatures8 process9 file10 88 C:\Users\user\AppData\Roaming\...\zlib1.dll, PE32 22->88 dropped 90 C:\Users\user\AppData\...\vmwarestring.dll, PE32 22->90 dropped 92 C:\Users\user\AppData\...\vmwarebase.dll, PE32 22->92 dropped 94 18 other malicious files 22->94 dropped 150 Modifies the context of a thread in another process (thread injection) 22->150 152 Found hidden mapped module (file has been removed from disk) 22->152 154 Maps a DLL or memory area into another process 22->154 156 2 other signatures 22->156 26 Transponder-Sonic.exe 9 22->26         started        30 AtoShard.exe 22->30         started        33 Crisp.exe 22->33         started        signatures11 process12 dnsIp13 96 C:\Users\user\AppData\Roaming\...\Crisp.exe, PE32 26->96 dropped 98 C:\Users\user\AppData\Local\...\3E53C78.tmp, PE32 26->98 dropped 100 C:\Users\user\AppData\Local\SynthSer.exe, PE32 26->100 dropped 158 Contain functionality to detect virtual machines 26->158 160 Found hidden mapped module (file has been removed from disk) 26->160 162 Maps a DLL or memory area into another process 26->162 35 cmd.exe 1 26->35         started        37 SynthSer.exe 26->37         started        124 176.9.142.218, 443, 49715, 49718 HETZNER-ASDE Germany 30->124 126 yoda.namunakhabartv.com 172.67.147.27, 443, 49781 CLOUDFLARENET-CloudflareIncUS Canada 30->126 102 C:\Users\user\AppData\Local\...\abefc90d.exe, PE32 30->102 dropped 164 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 30->164 166 Tries to harvest and steal ftp login credentials 30->166 168 Tries to harvest and steal browser information (history, passwords, etc) 30->168 174 6 other signatures 30->174 170 Unusual module load detection (module proxying) 33->170 172 Switches to a custom stack to bypass stack traces 33->172 file14 signatures15 process16 dnsIp17 41 cmd.exe 1 35->41         started        43 conhost.exe 35->43         started        118 104.20.23.154, 49816, 80 CLOUDFLARENET-CloudflareIncUS Canada 37->118 120 example.com 172.66.147.243, 49714, 49720, 49733 CLOUDFLARENET-CloudflareIncUS Canada 37->120 122 yoda-line.site 66.163.113.238, 3333, 49713, 49717 AS-GLOBALTELEHOST-GLOBALTELEHOSTCorpCA Canada 37->122 144 Query firmware table information (likely to detect VMs) 37->144 146 Unusual module load detection (module proxying) 37->146 148 Switches to a custom stack to bypass stack traces 37->148 signatures18 process19 process20 45 cmd.exe 1 41->45         started        48 conhost.exe 41->48         started        signatures21 178 Uses ping.exe to sleep 45->178 180 Uses cmd line tools excessively to alter registry or file data 45->180 182 Uses ping.exe to check the status of other devices and networks 45->182 184 Passes commands via pipe to a shell (likely to bypass AV or HIPS) 45->184 50 cmd.exe 1 45->50         started        53 cmd.exe 1 45->53         started        55 cmd.exe 1 45->55         started        57 17 other processes 45->57 process22 signatures23 128 Uses cmd line tools excessively to alter registry or file data 50->128 130 Passes commands via pipe to a shell (likely to bypass AV or HIPS) 50->130 59 cmd.exe 50->59         started        62 cmd.exe 50->62         started        64 cmd.exe 50->64         started        76 17 other processes 50->76 66 cmd.exe 1 53->66         started        68 cmd.exe 1 53->68         started        70 powershell.exe 7 55->70         started        72 mode.com 1 57->72         started        74 conhost.exe 57->74         started        process24 signatures25 176 Uses ping.exe to sleep 59->176 78 cmd.exe 64->78         started        process26
Score:
77%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout SFX 7z Win 32 Exe x86
Link:
https://app.malva.re/file/81d77907c33da994e5ca80dfdc1115f7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504/
Verdict:
Malicious
Threat:
Family.HIJACKLOADER
Link:
https://tip.neiki.dev/file/a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504
Threat name:
Win32.Trojan.Pomal
Create hunting rule
Status:
Malicious
First seen:
2026-05-25 19:40:17 UTC
File Type:
PE (Exe)
Extracted files:
140
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u6usaxswdl2o42lb5u2xzczdedoqgw6srzz4sschztcyfawrsuca._file
Verdict:
malicious
Label(s):
tinyutility
Create hunting rule
hijackloader
Create hunting rule
Similar samples:
error
GhostPulse
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader credential_access defense_evasion discovery loader spyware stealer
Link:
https://tria.ge/reports/260526-as6q7sct4z/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: AddClipboardFormatListener
Runs ping.exe
Modifies registry key
Modifies registry class
Modifies data under HKEY_USERS
Enumerates system info in registry
Checks processor information in registry
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Indicator Removal: File Deletion
Drops desktop.ini file(s)
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Unsecured Credentials: Credentials In Files
Reads user/profile data of web browsers
Reads data files stored by FTP clients
Reads WinSCP keys stored on the system
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Downloads MZ/PE file
Suspicious use of NtCreateProcessExOtherParentProcess
Family: HijackLoader, IDAT loader, Ghostulse,
Detects HijackLoader (aka IDAT Loader)
Unpacked files
SH256 hash:
a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504
MD5 hash:
81d77907c33da994e5ca80dfdc1115f7
SHA1 hash:
b16fec7b72667676d2f46739f70420a1ce4e90f8
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
ff3b91373bdc384451daed788f4ad52808ba2b33ec95e2e3e29744d724cd510d
MD5 hash:
473fceef98d476421eaf27bf5969a4b0
SHA1 hash:
4c19864b7b5f01755af3d60946da476549a02aa6
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
52db40ea7a5fc320da1886b37018bf42d7d3a51355ca003777b95a3775d38c71
MD5 hash:
f1ca33c085fdd576322cf5d9e3f0ae28
SHA1 hash:
66e964ddc38d5f11e57e737bb990f48a4a54b84d
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
2919aa1c3d038a07601913778608bc3d7bb99f40937bf0be39f5b604161b05c5
MD5 hash:
b56af828fe0c40d553be6026271237d5
SHA1 hash:
7e4d5c7c9ed344bbd50a2e427cf0d6fecc43ea7a
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
0b77bccdd0282c60323883075f019a602d238072fd7e2b78a3423b82e3150507
MD5 hash:
29c700d424ba44f2a1096c1d7d1f8bcc
SHA1 hash:
9909d5eb37043f6a92d636c2f1d1e9852ec45e62
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
5522bdf36708d660bd2e76b62e13c0da7d1d1dc428492738eb2aceda03e8032b
MD5 hash:
74e5da1c5df398056e00ee51d1b7628a
SHA1 hash:
a9349b66de2e64010c3b8031c158ee99da2ea621
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
2f8578cd2dba60113f244d9cb80042ddb66a7dbd8cf4b59238de77d39dc93b4d
MD5 hash:
49f4282ca6ba5d29060a8b7b4d0a245d
SHA1 hash:
d8cc01c2056fe59ddd21ddbc7b5688bf7dec39ee
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
dfc3b40c3404915ecb3c61c5b6b2ca5ae90ffab082dd9562120457634d07bc04
MD5 hash:
0bf8a862b066ced3eff71efff285e01e
SHA1 hash:
4ff00b7511e2c3c9d6a5ba9c199cb5a20539ef0b
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
4f3ff6006396f3df35a6527ebf4b744d5392605907a58862157c548cb8a1f49d
MD5 hash:
c3e6c0e08d8b141966e35777c125a42f
SHA1 hash:
be1fa25f581c5dba3024888474cb84c8f2aed1d8
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
b2a8c1da96b1c875f512dcff59c963edbace3c67fc9fede243d3283ff8251e3a
MD5 hash:
1aadb475b87945eb3897a095ea0e4833
SHA1 hash:
cda8f85b8982d10e243ece90784ac71cd7a4001b
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
711bc711c101edc5ba6b6831ab6020befdcd07c30851829e3eb1c04452f49b65
MD5 hash:
1b14f8ba9a27bd02d5e03addfc75303b
SHA1 hash:
f541f406708f81e6b601b29addafb62bc9f0647b
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
e3252fe2b91091d81d4da33eab8c388987103b4f1a5e2d1eedd77b551ff4e4c4
MD5 hash:
48f1e195f01261a28a6d892be56559ae
SHA1 hash:
070cc65b282d98562496781d73228c25e92f8f6f
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
46aa9c6a94367804c9cfca48748e2f9c72b695471f44d913af6fa0232f89e2b8
MD5 hash:
ba3ee3356d8fc0a8221154e244a552c3
SHA1 hash:
34a4b5bce07e0c2740341e954a14e75a535fb819
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
08a93ad91061aeda02121ae6a4fc9ec024f612e39626c615fd5f3765957608a4
MD5 hash:
2e259afb699d02eecfa0817e791e3324
SHA1 hash:
3873b36b6b1257dfa6543124383e932d553126a4
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
07961b16475dd5db86f1c1e774e780a010a4b7e480639ead3fcf5d141496f33e
MD5 hash:
9cca30cad2ecff62a240761c2a4543af
SHA1 hash:
52c1e228a27fd3084d18171f45eee307b103182d
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
c81550fbea63e38aa62af26f5f72c05f63597cb0ef8c056b7c5651c819602a14
MD5 hash:
31e38d9c4d50d44dffbaf313f41db30e
SHA1 hash:
56d71f437ffea76f4d2aca7a359be37426cf1b1d
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
d59bf35b4bd6bd2a9741084012031a9afee0c416da29457523c75db5569442ec
MD5 hash:
836085f852baf5f79e6278abe2161998
SHA1 hash:
7e6e45c0720bf3f930dd02ca00977a71ae3980a5
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
5006ba3feda0ab44c8b7901b9ac1024326aa3deb303f044ad3aa4292624d184b
MD5 hash:
dcbd6959944bf01316631b3ab7a37a1e
SHA1 hash:
967703d927b27f41af9682667ba556f4cfd10e49
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
eed385ee9f0aab1b15c6da1e6da45c7a95f20d37156863be768e18d18182b984
MD5 hash:
49e1808e44c2df08b9af312861a066d5
SHA1 hash:
9a41f619e020aa44d9cae678e59e88af97a58cc1
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0
MD5 hash:
cabb58bb5694f8b8269a73172c85b717
SHA1 hash:
9ed583c56385fed8e5e0757ddb2fdf025f96c807
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
4254eb77170790c6d0dd83ea859b0aa4bdb1c0d604ee6a99f309efdab4788277
MD5 hash:
dae4294b0c3c3e194241be123078177b
SHA1 hash:
ad16988c73220b67d0ef228941d4609944f2d6d9
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
2b6133481000e3a45003d37a068567222fe2b6f32fb75f26abf56b905195b8a2
MD5 hash:
05f7f603d18235af4ed5b5f2aa445525
SHA1 hash:
aec285ccb5ab849547d803a8d16f8f048e9d8d2c
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe
MD5 hash:
d4dae7149d6e4dab65ac554e55868e3b
SHA1 hash:
b3bea0a0a1f0a6f251bcf6a730a97acc933f269a
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
08d4c1c20b2777496eea3acd7e7c062a4d4e93d5f6966942a9292b7b9f42798d
MD5 hash:
868c58fd2361a042754c2c4cd268e296
SHA1 hash:
bb1f6f8bfb3214ab829ded369904877fc53cd732
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
817b664ae1cab5b142f363f7570e64689b7e1236330aa5e258f689736eecdc68
MD5 hash:
72b0a0c52d5e227b005898a5ec160de4
SHA1 hash:
c93d03dbd89398157a70926e333f0e62e6558b22
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
134fd6610a2ded494a9707d1a369e7bb767b8900c1416691620c832fcfacecfe
MD5 hash:
5c5879290a8f68ea3e36f45260177541
SHA1 hash:
d8a05f61d177adb3f4ef345e9b26b8eb13228b6a
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
70fb1a75df9b13fe7b6193e5d102237cf674c2c6577c893f89e6425754953547
MD5 hash:
16d9ec4498b5f14cee8e3cdcab01f4d1
SHA1 hash:
df28ea65702ee578e33f6719ae014d69c7f4cbad
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
758567c487cf2f08e9c76028f70781fa88e500776380ee2ef02ad2f2e6fd51da
MD5 hash:
1d56d97eaf0443f3b20a55966d60b7f3
SHA1 hash:
e46ad783ec335bf13e3b421bb65b73fefa1132b5
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
SH256 hash:
51e6e0a7533ecce04bf87cd9f5f6a6457c04ee305997da78091a0c9e4800bc63
MD5 hash:
7c3e4b3479aee8e0099702ae5ec3164a
SHA1 hash:
ee2f0cea0975000381ee0efe27e80b04baabf13c
Link:
https://www.unpac.me/results/dc90a910-36d5-4159-9f9f-55c1f5bcd0c1/
Malware family:
HijackLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a7a9205e561a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GhostPulse

Executable exe a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504

(this sample)

  
Link
https://tria.ge/260526-agavdsbz5t/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/67913/
  
URLhaus
https://urlhaus.abuse.ch/url/3853313/

Comments