MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa5045411ba7da09339ea56b718435ed4db6970b77a2495750427c3e0983f4b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa5045411ba7da09339ea56b718435ed4db6970b77a2495750427c3e0983f4b5
SHA3-384 hash: 1baff2e3ec931228eb3fa81450492879e2096cef4ff95fafc310ca63910b717feb0c465b4446e8169a8073ec727a6286
SHA1 hash: 30a88e1ba76824e2ce56e8bbdc771e87f7b0a791
MD5 hash: fe04a8e07af1dbc71f42f5426f8ea8f2
humanhash: monkey-foxtrot-paris-nine
File name:Setup.exe
Download: download sample
File size:16'878'068 bytes
First seen:2026-08-23 00:38:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b5a014d7eeb4c2042897567e1288a095 (24 x HijackLoader, 23 x GhostPulse, 14 x ValleyRAT)
ssdeep 393216:+pbs7d4Hda49iujQ/sqA/3GwsdCWIqpkEsc+1aId9rrl+vNLm/jP:e84HdJ9xjxnBitmEsxYIPrl6CLP
TLSH T1390733053F62A8F6D2AA80369E0EE3555835E2AA52C8CF17A3FC5E4E1ED3D7543430D9
TrID 42.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.8% (.EXE) Win64 Executable (generic) (6522/11/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4504/4/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon c292ecd8f2f6fe1c (23 x GhostPulse, 23 x HijackLoader, 11 x LummaStealer)
Reporter aachum
Tags:exe HIjackLoader SnappyClient vidar YodaTeam


Avatar
iamaachum
https://almaresd.xyz/ => https://www.mediafire.com/file/vmata9s6ssmcx85/SETUP_ARCHIVE_(KEY=1234).zip/file

Vidar C2:
62.238.125.82:443
https://telegram.me/s11yme
https://hbd.1234e.org/
SnappyClient C2:
yoda-time.ink (144.31.40.42:3333)

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/82541/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context adaptive-context evasive fingerprint hijackloader installer installer installer-heuristic microsoft_visual_cc overlay packed reconnaissance sfx
Link:
https://www.filescan.io/uploads/6a8a412f3210b0ff3919489d/reports/5781cb16-6b84-42f9-9d24-180f82bcfc9a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/aa5045411ba7da09339ea56b718435ed4db6970b77a2495750427c3e0983f4b5
Malware family:
IDAT Loader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b7260524-c4ed-4d1c-a355-eef468039c95
Result
Threat name:
HijackLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1962296
Signature
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Switches to a custom stack to bypass stack traces
Yara detected HijackLoader
Behaviour
Behavior Graph:
Download SVG
Score:
76%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/aa5045411ba7da09339ea56b718435ed4db6970b77a2495750427c3e0983f4b5
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout SFX 7z Win 32 Exe x86
Link:
https://app.malva.re/file/fe04a8e07af1dbc71f42f5426f8ea8f2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa5045411ba7da09339ea56b718435ed4db6970b77a2495750427c3e0983f4b5/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-23 00:39:34 UTC
File Type:
PE (Exe)
Extracted files:
1039
AV detection:
8 of 36 (22.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vjiekqi3u7nasm46uvvxdbbv5vg3nfylo6resv2qij6d4cmd6s2q._file
Verdict:
malicious
Label(s):
HijackLoader
Create hunting rule
Vidar
Create hunting rule
Link:
https://reports.threatray.com/ee7119d6-e7cb-4412-9f65-dfd48c4e19e9
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader discovery loader spyware stealer
Link:
https://tria.ge/reports/260823-azp22awtb1/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Unpacked files
SH256 hash:
aa5045411ba7da09339ea56b718435ed4db6970b77a2495750427c3e0983f4b5
MD5 hash:
fe04a8e07af1dbc71f42f5426f8ea8f2
SHA1 hash:
30a88e1ba76824e2ce56e8bbdc771e87f7b0a791
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
6fec7c478f790d0edcc4f0efb2594a64878ac8fc8878b03f3611311c920e29be
MD5 hash:
f908fe45f8fe9e0d4cbe65f9ff5df6da
SHA1 hash:
55bdf4ad2db61b8cd0b37011906b74a5505b3746
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
bf69ca50d8137b6e02e41755eb1d35b0b63fd3e81a2c466fff0375d55e1927a5
MD5 hash:
6e144ab2aaff763d8bee927a6a22b46d
SHA1 hash:
09c0a6ab4a5397b0166815f5b38a43a04d582302
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
08665cd47d89787a5a43f11055c8a504603387eb287e3a3e4604d16e84f90ac8
MD5 hash:
fa1f1917bd5e74984da4273e8d49ce95
SHA1 hash:
11cb8892bb5af9f0c5114fccd31dce2fb8d0d4a6
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
36dfa3fb9505b8b46df03de44f1d8cafdc591a8c15d8fd03ab06cdd5b2e64c9c
MD5 hash:
dcfbd4441ce5f37910632390f2e5dada
SHA1 hash:
150c537b069d5c2a1e30c2b0ac0770cd427b5411
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
f71809a2dce905eb1e5983e4188d15061215b46fadece12a86a9ecf9cec9a9bb
MD5 hash:
cfb6462843095f689f789ed6bd944921
SHA1 hash:
17aabc250f624c364e0cfdbdb953d7b10f6719c6
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
981f5e9feee76ea1e5a3181f826bb3b6a4d1e1cb2b97e317d899899a526d06a8
MD5 hash:
77d26c2ede696f09ecbf9a887711e131
SHA1 hash:
31a8b3bd31beb2883f8e91617fe305a233d65d2a
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
622cd1ac8793cc6052df75686f6809180a4fe7cd6bcd1d16177247aad8e9835b
MD5 hash:
964dc3abad86b2b8ec83d02a485d1fbb
SHA1 hash:
38c254512d4b752c1f47f8ce022f20126150486b
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
dde98526188784e6acd07471dda364c3a25d2296d6a8cf8ef7dbec1f394d31a7
MD5 hash:
43d8b41cadb41d5afbc8298065d90800
SHA1 hash:
4a7d5ae2e95cfd27c859065ace2659748edcd674
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
27b29abc7ff4ca2547161e7340351f085c35c4bd30a9eec7bcf5dde9cfbf7136
MD5 hash:
2740c78c5fb9b8204317ca116718f69a
SHA1 hash:
5fbd7ca6692ae7c422a1c7ae479b3d81d650b549
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
5ee37008f37410fff0225b898dd46d3bb32f66dfe73f671636d0c93e881e73b6
MD5 hash:
99b273fc76fba01bf548bb10e6fd83e6
SHA1 hash:
9d057b02a043527f4f527c0953f29a1719dc4837
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0
MD5 hash:
cabb58bb5694f8b8269a73172c85b717
SHA1 hash:
9ed583c56385fed8e5e0757ddb2fdf025f96c807
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
5164cbb5b017388f828cebcc3a1eddfe8a6447612a9bfc06f81189c001497992
MD5 hash:
a777d4ca1a6bdd0aa8032029d409e322
SHA1 hash:
b1745dade7449e5a10bf9680645981f9268cd10c
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
SH256 hash:
68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe
MD5 hash:
d4dae7149d6e4dab65ac554e55868e3b
SHA1 hash:
b3bea0a0a1f0a6f251bcf6a730a97acc933f269a
Link:
https://www.unpac.me/results/844b8e25-14e8-4266-b4e0-a3c4ac736ad3/
Malware family:
HijackLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aa5045411ba7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe aa5045411ba7da09339ea56b718435ed4db6970b77a2495750427c3e0983f4b5

(this sample)

  
Link
https://tria.ge/260823-aq6y7a1ekg/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/82541/

Comments