🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7b5e81ca69f663e63562844a11a261eaeff5767f16702d8b67dbfac01098067. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SeroRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7b5e81ca69f663e63562844a11a261eaeff5767f16702d8b67dbfac01098067
SHA3-384 hash: c8eb838b7300d6cc782f059c83e5f45a8eacba8ab5002585655ee0ca2fcb3837156d5329e5683fc772262bda93d53ba6
SHA1 hash: e8b34ffdcea5490f5ab87ada12301a31cd8c0c87
MD5 hash: cfaa9eead8f27ecc01803a5eb9fc463c
humanhash: may-ten-crazy-earth
File name:Letter_e_invite_19283942392845894233293483294342_pdf.exe
Download: download sample
Signature SeroRAT
Create hunting rule
File size:9'195'008 bytes
First seen:2026-09-18 19:44:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 923bdfaeefbab6fa43aca538ebe63b78 (1 x SeroRAT)
ssdeep 196608:c06ngZMtEk8WBaW61sHLjCGAVIQoMP5xXjaFcQB9aOMHTpzu:cpng+Ek8WcW61GChH5VaFlCNzu
TLSH T140963391BF5285FCE1A2D636C868421444563E5C498FEBAF3098FB277AB31810D76F72
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 68d8d8c8d9a9c1d9 (96 x SnakeKeylogger, 77 x Formbook, 75 x RemcosRAT)
Reporter smica83
Tags:exe SeroRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-18 19:51:16 UTC
Tags:
auto-sch auto-startup auto-reg generic telegram ip-check stealer evasion ims-api amsi-bypass
Link:
https://app.any.run/tasks/f628a0e4-f7cd-4662-b0d0-47b24ff90c8d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/86766/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.41731761.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Сreating synchronization primitives
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Adding an access-denied ACE
Launching a process
Loading a suspicious library
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm masquerade microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/6aad94d4dac2794332da6fbc/reports/de405e39-d468-4a02-b613-66ce72407fa5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/a7b5e81ca69f663e63562844a11a261eaeff5767f16702d8b67dbfac01098067
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-09-16T17:57:00Z UTC
Last seen:
2026-09-19T22:27:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a7b5e81ca69f663e63562844a11a261eaeff5767f16702d8b67dbfac01098067/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/07ca0fca-a97e-43a4-9012-a3941a8ee785
Result
Threat name:
Clipboard Hijacker, SeroRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1974976
Signature
Antivirus detection for dropped file
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Sigma detected: Potentially Suspicious Malware Callback Communication
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Yara detected PersistenceViaHiddenTask
Yara detected SeroRAT
Yara detected Telegram RAT
Yara detected Telegram Recon
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1974976 Sample: Letter_e_invite_19283942392... Startdate: 18/09/2026 Architecture: WINDOWS Score: 100 104 api.telegram.org 2->104 106 ip-api.com 2->106 108 api.ipify.org 2->108 118 Suricata IDS alerts for network traffic 2->118 120 Found malware configuration 2->120 122 Antivirus detection for dropped file 2->122 126 11 other signatures 2->126 12 Letter_e_invite_19283942392845894233293483294342_pdf.exe 2 2->12         started        16 windows.exe 2->16         started        18 windows.exe 2->18         started        signatures3 124 Uses the Telegram API (likely for C&C communication) 104->124 process4 file5 98 C:\Users\user\AppData\...\msedge_E101AD2E.exe, PE32+ 12->98 dropped 142 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->142 20 msedge_E101AD2E.exe 2 12->20         started        signatures6 process7 file8 96 C:\Users\user\AppData\Roaming\...\windows.exe, PE32+ 20->96 dropped 128 Antivirus detection for dropped file 20->128 130 Multi AV Scanner detection for dropped file 20->130 132 Tries to detect sandboxes / dynamic malware analysis system (registry check) 20->132 24 windows.exe 20->24         started        signatures9 process10 signatures11 134 Antivirus detection for dropped file 24->134 136 Multi AV Scanner detection for dropped file 24->136 138 Uses schtasks.exe or at.exe to add and modify task schedules 24->138 140 6 other signatures 24->140 27 RuntimeBroker.exe 3 2 24->27         started        32 windows.exe 1 2 24->32         started        process12 dnsIp13 110 5.226.55.130, 4444, 49743 HYONIX-HyonixSG United States 27->110 112 ip-api.com 208.95.112.1, 49744, 80 TUT-AS-TotalUptimeTechnologiesLLCUS United States 27->112 114 2 other IPs or domains 27->114 100 C:\Users\user\AppData\Local\...\svchost.dat, PE32+ 27->100 dropped 144 Writes to foreign memory regions 27->144 146 Modifies the context of a thread in another process (thread injection) 27->146 148 Maps a DLL or memory area into another process 27->148 150 3 other signatures 27->150 34 windows.exe 1 27->34         started        37 windows.exe 1 27->37         started        39 windows.exe 1 27->39         started        49 10 other processes 27->49 102 C:\Users\user\AppData\...\jgizok44.l4m.xml, XML 32->102 dropped 41 schtasks.exe 1 32->41         started        43 schtasks.exe 1 32->43         started        45 schtasks.exe 1 32->45         started        47 schtasks.exe 1 32->47         started        file14 signatures15 process16 file17 88 C:\Users\user\AppData\...\wdmyrhz5.mse.xml, XML 34->88 dropped 62 4 other processes 34->62 90 C:\Users\user\AppData\...\shjn10qp.jbo.xml, XML 37->90 dropped 52 schtasks.exe 1 37->52         started        64 3 other processes 37->64 92 C:\Users\user\AppData\...\4x0lap5u.vx4.xml, XML 39->92 dropped 66 3 other processes 39->66 54 conhost.exe 41->54         started        56 conhost.exe 43->56         started        58 conhost.exe 45->58         started        60 conhost.exe 47->60         started        94 C:\Users\user\AppData\...\egy4hjqv.jm5.xml, XML 49->94 dropped 116 Unusual module load detection (module proxying) 49->116 68 5 other processes 49->68 signatures18 process19 process20 70 conhost.exe 52->70         started        72 conhost.exe 62->72         started        74 conhost.exe 62->74         started        76 conhost.exe 62->76         started        78 conhost.exe 62->78         started        80 conhost.exe 64->80         started        82 conhost.exe 64->82         started        84 conhost.exe 64->84         started        86 3 other processes 66->86
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a7b5e81ca69f663e63562844a11a261eaeff5767f16702d8b67dbfac01098067
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/cfaa9eead8f27ecc01803a5eb9fc463c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7b5e81ca69f663e63562844a11a261eaeff5767f16702d8b67dbfac01098067/
Threat name:
Win64.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2026-09-18 08:51:10 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u626qhfgt5td4y2wfbckcgrgd2xp6v3h6ftqfwfwpw72yaijqbtq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion trojan
Link:
https://tria.ge/reports/260918-ygkllacg23/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes dropped EXE
Windows security modification
Suspicious use of NtCreateUserProcessOtherParentProcess
Windows security bypass
Unpacked files
SH256 hash:
a7b5e81ca69f663e63562844a11a261eaeff5767f16702d8b67dbfac01098067
MD5 hash:
cfaa9eead8f27ecc01803a5eb9fc463c
SHA1 hash:
e8b34ffdcea5490f5ab87ada12301a31cd8c0c87
Link:
https://www.unpac.me/results/0ef781b2-a81d-4ec4-93da-6b6ecd781775/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a7b5e81ca69f663e63562844a11a261eaeff5767f16702d8b67dbfac01098067

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/86766/

Comments