MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa40614b8749762597d022b58b0a1e6c958eaae496ab189d90426911b8842253. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa40614b8749762597d022b58b0a1e6c958eaae496ab189d90426911b8842253
SHA3-384 hash: 69e97750dff6a595f5006c194dd3a390597050edb8f4123804a366a48548d10523276b12174923e4c26c810da7c12ecf
SHA1 hash: 5a697b47a047c4ee4e935d5806e9aaa79c19153e
MD5 hash: 338a5f705fdfef2c87b651b960c78a8f
humanhash: high-cat-victor-uniform
File name:338a5f705fdfef2c87b651b960c78a8f.exe
Download: download sample
File size:3'577'344 bytes
First seen:2025-09-24 16:19:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 98304:sW6UGdzPGmfv3e6mtvTAQMPrrXTu4rDX8ucbpF1TwWXdD:sW6UV8vu6SC3T3b8pbtTL
Threatray 31 similar samples on MalwareBazaar
TLSH T12EF5339F3E9E3981C8FA603D392BA9421389E919528EDEFFD1515C617124F9F3B4C260
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
338a5f705fdfef2c87b651b960c78a8f.exe
Verdict:
No threats detected
Analysis date:
2025-09-24 17:54:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/08e164d4-6c07-4cc3-b472-030ce85fbb95

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28841/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d54622cc9425144151d805
Tags:
azorult packed virus msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult crypt limecrypter nanocore obfuscated packed packed packer_detected razy
Link:
https://www.filescan.io/uploads/68d41b3a674d5fd6aa0b65c9/reports/643edbd0-9c2b-47b4-9591-abd39bdc77b9/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/aa40614b8749762597d022b58b0a1e6c958eaae496ab189d90426911b8842253
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-17T08:32:00Z UTC
Last seen:
2025-09-17T08:32:00Z UTC
Hits:
~10
Detections:
Trojan-PSW.Win64.Salat.sb Trojan-PSW.Win32.Coins.sb Trojan.Win32.Inject.sb Trojan.MSIL.Agent.sb HEUR:Trojan-PSW.MSIL.Azorult.gen HEUR:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/aa40614b8749762597d022b58b0a1e6c958eaae496ab189d90426911b8842253/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f45bec4b-1401-4f97-acf6-aca215812cf1
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1783423
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1783423 Sample: qqJyg54iYN.exe Startdate: 24/09/2025 Architecture: WINDOWS Score: 76 19 Malicious sample detected (through community Yara rule) 2->19 21 Antivirus / Scanner detection for submitted sample 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 3 other signatures 2->25 6 qqJyg54iYN.exe 3 2->6         started        process3 file4 17 C:\Users\user\AppData\...\qqJyg54iYN.exe.log, ASCII 6->17 dropped 9 RegAsm.exe 6->9         started        11 RegAsm.exe 6->11         started        13 RegAsm.exe 6->13         started        15 2 other processes 6->15 process5
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/aa40614b8749762597d022b58b0a1e6c958eaae496ab189d90426911b8842253
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.01 Win 32 Exe x86
Link:
https://app.malva.re/file/338a5f705fdfef2c87b651b960c78a8f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa40614b8749762597d022b58b0a1e6c958eaae496ab189d90426911b8842253/
Verdict:
Malicious
Threat:
Trojan-PSW.Win32.Inject
Link:
https://tip.neiki.dev/file/aa40614b8749762597d022b58b0a1e6c958eaae496ab189d90426911b8842253
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2025-09-17 13:38:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
32 of 38 (84.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vjagcs4hjf3clf6qek2ywcq6nsky5kxes2vrrhmqijurdoeeejjq._file
Verdict:
malicious
Label(s):
salatstealer
Create hunting rule
Similar samples:
0180a183276b7fe640d1c371119806578fa7ef5fce0bbb9d4365fd00396ab0fd
0acd38d5a035fba9c1696ff905efb055c87ed33a185edf7b1a37daabf627f810
12d62d40ab342d697ddde068595d6c8d04f6208a4ce75b0776275c09415a1ff1
1bfd6286fd0a54a5036984b8a43cce66c786cfa350b2aa0fada8ac6a3e7e5b7e
24c820fbf7376c4db374ba3e5267ee6eb2e9c03b31ce1b77528bc67451be0833
45195185d9050a2b525fe32bf2c611ee77462fe6e5f74a6c1a7987bba86499e3
463d6d0e362d78e3664ce4a8dce86d59aa2a38a22efdb962c081a06014667c4a
cbb9547d9525f52f544202a9568b7aef830ec2565ec4eff9527715b5da5c917c
error
+ 21 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250924-twz8dazxe1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Verdict:
Malicious
Tags:
Win.Packed.Razy-7334624-0
YARA:
n/a
Link:
https://app.threat.zone/submission/70fc4feb-305f-4394-be9c-dc368047ffdc
Unpacked files
SH256 hash:
aa40614b8749762597d022b58b0a1e6c958eaae496ab189d90426911b8842253
MD5 hash:
338a5f705fdfef2c87b651b960c78a8f
SHA1 hash:
5a697b47a047c4ee4e935d5806e9aaa79c19153e
Link:
https://www.unpac.me/results/30451578-41a7-4f68-803c-f6a4046ffcdc/
SH256 hash:
fe1170c1115318d4aa883b3aebe5614a12bca00c6c3a2a649adfddb213810400
MD5 hash:
9a42f902eeb8ff14b2eb1ad60e128751
SHA1 hash:
8ec075ff41e4a794cda9a15aa62663af83a37acb
Detections:
SUSP_Imphash_Mar23_3
Create hunting rule
Link:
https://www.unpac.me/results/30451578-41a7-4f68-803c-f6a4046ffcdc/
SH256 hash:
a0b5d6982cb8d022ef38e4a85c363b156fb5bd31ff8b862bed92bacda0e488c4
MD5 hash:
69df221f58955f07c55be6cd2209b787
SHA1 hash:
6310599aa2dd6d59c65bc6cf539a4310f8172c23
Detections:
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Link:
https://www.unpac.me/results/30451578-41a7-4f68-803c-f6a4046ffcdc/
SH256 hash:
bb987b0698dfd43609f8e4a2eaa2ba690aed99b4ea3a2c4c103409f9f3c0d0df
MD5 hash:
b3937f287973d95888fc0db9fe0302c1
SHA1 hash:
3a2e2e7182a410f03949fab3db5e177d84bd9fc2
Detections:
MAL_NET_LimeCrypter_RunPE_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/30451578-41a7-4f68-803c-f6a4046ffcdc/
SH256 hash:
6cf1a2131d155630454ca7421b55bec7838c5e120b4a6642fb5e079fcc5a2f25
MD5 hash:
f1f81631b6394de1029bfb9426166b74
SHA1 hash:
7fd4285755438fac520b8f4503715ba82d7967f0
Link:
https://www.unpac.me/results/30451578-41a7-4f68-803c-f6a4046ffcdc/
SH256 hash:
9e132dbebb61486e8c79791d9220731a25fc09dded35507427d8a82bd9607def
MD5 hash:
91e886eb6b40e10f08612b7052ae0349
SHA1 hash:
45f8519011d26c4fe4daa754975c9bcbc4263f65
Link:
https://www.unpac.me/results/30451578-41a7-4f68-803c-f6a4046ffcdc/
SH256 hash:
2f78455ab92f7a5023527f644b7ac380dcac91569a62c32c24282417931927e7
MD5 hash:
7a9dbfad1afeb12d774266dd5ad1458b
SHA1 hash:
84c068803e53fcdc5a32a7f01d509646639529e4
Detections:
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Link:
https://www.unpac.me/results/30451578-41a7-4f68-803c-f6a4046ffcdc/
Malware family:
SalatStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aa40614b8749/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa40614b8749762597d022b58b0a1e6c958eaae496ab189d90426911b8842253

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:INDICATOR_EXE_Packed_NyanXCat_CSharpLoader
Create hunting rule
Author:ditekSHen
Description:Detects .NET executables utilizing NyanX-CAT C# Loader
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/28841/

Comments