MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8977835c0902ff41c536597be155d1fe6f66af9be6d435c186fbce1cfc5f3b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Spambot.Kelihos


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8977835c0902ff41c536597be155d1fe6f66af9be6d435c186fbce1cfc5f3b8
SHA3-384 hash: 465a5fe90fbc079bcb5faa9229dada7fbcb82278dfff058a2afe376a30739a974de3532b909b4384f87d7c4ae318c07f
SHA1 hash: 106d36a7cc749575bdf6891ef1efa6997d5f239e
MD5 hash: 1647a78f3b8e4419628368026534b89f
humanhash: wolfram-glucose-freddie-johnny
File name:Internet.Download.Manager.v6.42.36.exe
Download: download sample
Signature Spambot.Kelihos
Create hunting rule
File size:9'848'297 bytes
First seen:2025-05-17 11:23:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 46ce5c12b293febbeb513b196aa7f843 (14 x GuLoader, 6 x RemcosRAT, 5 x VIPKeylogger)
ssdeep 196608:/p54f41oEipeLYQq8IBRGkOj/RzzFXr2KuQY7sU1cIVn9hqL:/p6fbl8LYQq8uRGkMhr26U3w
TLSH T1FBA6331D4282D280D6064A3EF4919BEB0D0FEA45137AE357FBC1E75477E6B82A974B03
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon e1e0e2f3e6ec3823 (4 x XWorm, 2 x njrat, 2 x Spambot.Kelihos)
Reporter Gasr
Tags:exe Spambot.Kelihos

Intelligence

File Origin
# of uploads :
1
# of downloads :
575
Origin country :
RU RU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Internet.Download.Manager.v6.42.36.exe
Verdict:
Malicious activity
Analysis date:
2025-05-17 11:11:35 UTC
Tags:
auto-reg pastebin idm tool arch-exec arch-scr java auto generic arch-html
Link:
https://app.any.run/tasks/5d496560-7ea9-4180-a3b7-9185460e56a6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.FileRepMalware.6621.28803.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68286ee7375681df7c1a0cb1
Tags:
infosteal nsis
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a file
Delayed reading of the file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context blackhole installer microsoft_visual_cc overlay overlay packed packer_detected
Link:
https://www.filescan.io/uploads/682871c6c609634bd7c6dc09/reports/30dc7cdb-6e7a-4236-b340-229c2ffe3a89/overview
Verdict:
Malicious
Labled as:
GrayWare[AdWare]/NSIS.AdPack
Link:
https://www.hybrid-analysis.com/sample/a8977835c0902ff41c536597be155d1fe6f66af9be6d435c186fbce1cfc5f3b8
Malware family:
Mobatek
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9caa73f4-29f5-41fc-8ff4-3117024c6b0e
Result
Threat name:
n/a
Detection:
malicious
Classification:
bank.troj.adwa.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1692822
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Found suspicious ZIP file
Installs a browser helper object (BHO)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
PE file has a writeable .text section
Possible COM Object hijacking
Sample is not signed and drops a device driver
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1692822 Sample: Internet.Download.Manager.v... Startdate: 17/05/2025 Architecture: WINDOWS Score: 72 102 Multi AV Scanner detection for dropped file 2->102 104 Multi AV Scanner detection for submitted file 2->104 106 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->106 108 3 other signatures 2->108 9 Internet.Download.Manager.v6.42.36.exe 32 253 2->9         started        14 svchost.exe 2->14         started        16 svchost.exe 2->16         started        18 4 other processes 2->18 process3 dnsIp4 98 159.69.51.117 HETZNER-ASDE Germany 9->98 100 104.22.68.199 CLOUDFLARENETUS United States 9->100 90 C:\Users\user\AppData\Local\...\registry.dll, PE32 9->90 dropped 92 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 9->92 dropped 94 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 9->94 dropped 96 51 other files (16 malicious) 9->96 dropped 122 Sample is not signed and drops a device driver 9->122 20 IDMan.exe 9->20         started        24 Uninstall.exe 1 1 9->24         started        26 regsvr32.exe 9->26         started        32 4 other processes 9->32 28 drvinst.exe 14->28         started        30 drvinst.exe 14->30         started        124 Changes security center settings (notifications, updates, antivirus, firewall) 16->124 file5 signatures6 process7 file8 74 C:\Users\user\AppData\Roaming\...\idmmzcc.dll, PE32 20->74 dropped 76 C:\Users\user\AppData\...\idmmzcc64.dll, PE32+ 20->76 dropped 78 C:\Users\user\AppData\Roaming\...\idmmzcc.dll, PE32 20->78 dropped 84 4 other malicious files 20->84 dropped 110 Creates an undocumented autostart registry key 20->110 112 Creates multiple autostart registry keys 20->112 114 Installs a browser helper object (BHO) 20->114 34 regsvr32.exe 20->34         started        36 rundll32.exe 24->36         started        40 net.exe 24->40         started        42 net.exe 24->42         started        52 5 other processes 24->52 44 regsvr32.exe 5 26->44         started        80 C:\Windows\System32\...\idmwfp64.sys (copy), PE32+ 28->80 dropped 82 C:\Windows\System32\...\SETD88D.tmp, PE32+ 28->82 dropped 46 regsvr32.exe 71 32->46         started        48 regsvr32.exe 41 32->48         started        50 regsvr32.exe 23 32->50         started        signatures9 process10 file11 86 C:\Users\user\AppData\...\idmwfp64.sys (copy), PE32+ 36->86 dropped 88 C:\Users\user\AppData\Local\...\SETD6D8.tmp, PE32+ 36->88 dropped 116 Creates multiple autostart registry keys 36->116 118 Creates an autostart registry key pointing to binary in C:\Windows 36->118 54 runonce.exe 36->54         started        56 conhost.exe 40->56         started        58 net1.exe 40->58         started        60 conhost.exe 42->60         started        62 net1.exe 42->62         started        120 Creates an undocumented autostart registry key 44->120 64 conhost.exe 52->64         started        66 net1.exe 52->66         started        68 conhost.exe 52->68         started        70 6 other processes 52->70 signatures12 process13 process14 72 grpconv.exe 54->72         started       
Score:
47%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/a8977835c0902ff41c536597be155d1fe6f66af9be6d435c186fbce1cfc5f3b8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8977835c0902ff41c536597be155d1fe6f66af9be6d435c186fbce1cfc5f3b8/
Threat name:
Win32.Trojan.Fixflo
Create hunting rule
Status:
Malicious
First seen:
2025-05-09 06:40:30 UTC
File Type:
PE (Exe)
Extracted files:
1710
AV detection:
18 of 37 (48.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vclxqnoasax7ihctmwl34fk5d7tpm2xzxzwugxayn66odt6f6o4a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware discovery execution persistence phishing privilege_escalation spyware stealer
Link:
https://tria.ge/reports/250517-nhnpjasmv5/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks installed software on the system
Enumerates connected drives
Installs/modifies Browser Helper Object
Legitimate hosting services abused for malware hosting/C2
A potential corporate email address has been identified in the URL: mozillacc3@internetdownloadmanager.com
Checks computer location settings
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Drops file in Drivers directory
Unpacked files
SH256 hash:
a8977835c0902ff41c536597be155d1fe6f66af9be6d435c186fbce1cfc5f3b8
MD5 hash:
1647a78f3b8e4419628368026534b89f
SHA1 hash:
106d36a7cc749575bdf6891ef1efa6997d5f239e
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
986db3fc7426d1475b2048be9554fc6f4e4114050b3a43e1e980b5daeb6ec005
MD5 hash:
d9407a70b1727c420820cffbdc6e6082
SHA1 hash:
ba8ce5aef380edc29780ca2226193df26e6bfac4
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
917ff576998f4ec99f58f8a1df14b219adadd227d51ca0ff9e38e50b767c09d9
MD5 hash:
3e1364d5849de78d65c37fe3ccf411ca
SHA1 hash:
5e48e4a9248690d6e1764a84ce3cf546d815c8ab
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
caffd6fedeb8c5720725171f2f72b977dd22e98db1ceb053ba14c130323e4465
MD5 hash:
41066cce37e0d22bc96e6393dd492d80
SHA1 hash:
abd0ef829a5fe3a0d7059567a3e58b7e73c1f67c
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
b91ee87ec45b648453b4001d51512da936acbbcd6b9e09cb4edd02697094fb3a
MD5 hash:
e25e6dfdd1bae389d76d97aac3b6e961
SHA1 hash:
0e12224c405934e27e657858af7ca8a375a424e3
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
b76e5d4d0eb93f7e9f4b8c4a068c88b06150fc065cf150b962681b1825dced7c
MD5 hash:
9646fce84dc3be67def77da427e69a4d
SHA1 hash:
1182a2171be326cf99948c5088422d802d80a1dc
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 hash:
8f0e7415f33843431df308bb8e06af81
SHA1 hash:
1314272e6ad3be1985d4a1607b890a34b0bde8b5
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
ec40e745386fbe4775c9785dafe9033a5e2eda8504aa08aa8c195ba0020eb314
MD5 hash:
24398e5878ed29401af934624fc58f2c
SHA1 hash:
2aeea97f61833b2ab86cbdef30267f9d55749e9a
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 hash:
2b7007ed0262ca02ef69d8990815cbeb
SHA1 hash:
2eabe4f755213666dbbbde024a5235ddde02b47f
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
92769e02b7fd474a1df145ab0b46de98de4bd0c1af4a9f0dcd8d7d672f16310d
MD5 hash:
38e848b6d64289f3b20ef2b705eb2578
SHA1 hash:
3025f9de240014699cb527dc68bde0672e7c84ea
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 hash:
80e44ce4895304c6a3a831310fbf8cd0
SHA1 hash:
36bd49ae21c460be5753a904b4501f1abca53508
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
1fb43ab748bb3925ac70b45039d4d623a2862b91a0c75a4ec828378bf4d9c464
MD5 hash:
3000ad01f7b0da36ce26f909e69a115a
SHA1 hash:
515756aa2bdf29cbf118d12178ee080d9a05d876
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
0c97d8a591363d6a6bb8da8f5d88f88ca52010b622219ce40a3b05bb709d9c12
MD5 hash:
4174f60575e7e620a766a6ab0f688231
SHA1 hash:
59f411e9a3c439793422be6ebc20dea16a1351d0
Detections:
win_oski_g0
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 hash:
4b8a750993567ac9a350ba9768fabfa0
SHA1 hash:
7ee7a8c313b292d62561b085c9d490c0f8065624
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
fdc69180a674aa386442c581c4ffe9b2e1f268d9829384e083bf08e8b1b2b987
MD5 hash:
77bdf74fe579db6702e234cd4eef59a9
SHA1 hash:
853fe64d3e409b2106f99ebc8a30fd76af0552ea
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
8fcca62c1d53a0c331768cf309bf7bf9df2ffc356fa254c85bd77a3582240578
MD5 hash:
0e3c060bbf1e4bf1dabd2bc15ce1f05b
SHA1 hash:
8d5900aff0feb85cd9d9ad620a2fcfa0c9e28d0e
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
86b6cb434a0491ea16bf480e6ad16c935d0668535da17aa7df0dc4392e10d74e
MD5 hash:
6d57b2cc33721890cd11cc604805362e
SHA1 hash:
900c5fb5b7cd1194a25a80468076324dc6c03ac8
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
a052db86c0bd9d001a5de6e07a89dfce83275361161036456fbf220bbaa490cf
MD5 hash:
bbafc2c08002f71ccad3f5e587994ef2
SHA1 hash:
90b3150c599d0bc33d84677fc9901095be1ff0dc
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
e51906dccf4ffe52ebcc4c12de748bdc968b475e6447d9e40a75d50067c2f9b3
MD5 hash:
a8ba80f2dcea6e3aff7d78ad60d1bdd1
SHA1 hash:
924d44707d2fd1a5b2a8147f6187244c2343e15c
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 hash:
9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 hash:
97332a2ffcf12a3e3f27e7c05213b5d7faa13735
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
1672d02debd395abb88acde3a5194aa1e4cf6260f304887a806a481b1da6def6
MD5 hash:
daaefad1b8c9b2c6788385a9d49ff43a
SHA1 hash:
a2efb27f4ebb81a5a0680c4e2d65fbae2859c2d3
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
67249ec47f513a31d09ae52f767448fe47f996c605ac2eea7e3b93cbe87034f8
MD5 hash:
c34add7343e27b5218057434a5fcc612
SHA1 hash:
ac7b435473870233ab56fb64d4844f2e5d18227a
Detections:
win_samsam_auto
Create hunting rule
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
Parent samples :
0f2c02b866a9990dcf667998226ae2c56c7d018da0f2c654a1c1e2f12c16cb14
a8977835c0902ff41c536597be155d1fe6f66af9be6d435c186fbce1cfc5f3b8
SH256 hash:
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 hash:
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 hash:
b058e3fcfb7b550041da16bf10d8837024c38bf6
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 hash:
8fe362ffdfa66269b8a64e3a87f68e52
SHA1 hash:
b5daaa60a6b8591a670da9fc3a2d6f896d55f568
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
5b9b67c2a3197f7adc73cd2c18f231f1bf58b482e8da8c0231cfed94b4cba9dc
MD5 hash:
3e50fdabe9f4e30cfe510d6abcacb13a
SHA1 hash:
bae373d445defaf7f9a86c9d3726f686ba8b0b23
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
44ff52fc28e289387d547cb95c0fa4b213f7d05e55628146786b17a3f5f7cfdd
MD5 hash:
8913994d8682a3820fafab58d8e8a57b
SHA1 hash:
bcda20849c0f1beb0198400ee37bcb59de0fb99f
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
f23cb55591027469ca4a1f220fcea82d1fa634dd681b802d1c1fb63a1a3fdf02
MD5 hash:
024b1252cdfb738f3269b8d0caa36a38
SHA1 hash:
be668109b1674db77526d87383d7419ba78fadd3
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
4c9a420ae7503431821d590c71d4fd6378f6a92b2c7388a2a08cabe55af0c9f6
MD5 hash:
3dbe77d67cb6e7380e0c036074e5e4d0
SHA1 hash:
c48ca52f2b5f9dac314d56ca8605c7510be102c6
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
6cd3bef9727809624feed99a839db9489b5bcb6c22f65985d371558ca31b72e4
MD5 hash:
51d0b79bb9cbf765ed882999c3251888
SHA1 hash:
dfe8c78cf8aba822a5b93ae5f52c21227d4dc13e
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
4192ba66cbc5f20c7b80fba5b8783b3951d0df66974f1feb8111fd2444f7456f
MD5 hash:
d80093adbec6af3e50e6b3e3c53dada6
SHA1 hash:
e245840e814f0127a37e1642046ef145519e566a
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
83005624a3c515e8e4454a416693ba0fbf384ff5ea0e1471f520dfae790d4ab7
MD5 hash:
38f2b22967573a872426d05bdc1a1a70
SHA1 hash:
ecae471eb4e515e1006fce645a82b70c8acda451
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
MD5 hash:
b7d0d765c151d235165823b48554e442
SHA1 hash:
fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
SH256 hash:
d2ed65a6d7573ee85683c79b990d95af3a1c1334faebb45d862d46fcf8be4635
MD5 hash:
ea137eae73bec074e2e758271d4ebe54
SHA1 hash:
9d58cf8c2f6e6a92d51f9e4b6850dcf005e2a1f9
Link:
https://www.unpac.me/results/a1d6cefb-3112-4230-a0a0-e4db6b00372f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a8977835c0902ff41c536597be155d1fe6f66af9be6d435c186fbce1cfc5f3b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments