MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aac8e8b0ae4e24a49302b2279cb60025d98694d281e46be2ef6fc23cc9ccf673. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 15

Intelligence 15 IOCs YARA 14 File information Comments

SHA256 hash:	aac8e8b0ae4e24a49302b2279cb60025d98694d281e46be2ef6fc23cc9ccf673
SHA3-384 hash:	a032b1e6e10c9b4ea72d87f5f8241a638c131e7b15035757392d5a5d1fd4fef840cf21332b475314bf2c9b03155a5a88
SHA1 hash:	b1363727177760c8568fe90749b166f24bd06343
MD5 hash:	d21c8560e55514e9c50b46f50cd04d65
humanhash:	harry-asparagus-william-zebra
File name:	6b2dba0a80b51d0de0383bd41ff6df957a162ad36946958ec661d9e4a1e35c4d
Download:	download sample
File size:	1'951'232 bytes
First seen:	2026-06-30 07:40:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5f49ecf49fa72185df61ca769fcae7f7
ssdeep	49152:XIVhKA3ZDPrfoGO43ZdFNmMkUrQF/VPsej56yS:4nKAhTwGOKvFDkDBj5u
Threatray	56 similar samples on MalwareBazaar
TLSH	T189959D51FF82CDF1E585067180AAA73F8A3AD61C4790CEC3F2865965EC106D2FA3939D
TrID	38.2% (.EXE) Win64 Executable (generic) (6522/11/2) 26.4% (.EXE) Win32 Executable (generic) (4504/4/1) 11.8% (.EXE) OS/2 Executable (generic) (2029/13) 11.7% (.EXE) Generic Win/DOS Executable (2002/3) 11.7% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 6b2dba0a80b51d0de0383bd41ff6df957a162ad36946958ec661d9e4a1e35c4d

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	869'376 bytes
File size (de-compressed) :	1'951'232 bytes
Format:	win32/pe
Packed file:	6b2dba0a80b51d0de0383bd41ff6df957a162ad36946958ec661d9e4a1e35c4d

Intelligence

File Origin

# of uploads :

# of downloads :

144

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Dave

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ef0d43ad-408d-4841-90a3-bb65d052f47e/

Malware family:

andromeda

ID:

File name:

2026-06-01_d21c8560e55514e9c50b46f50cd04d65_amadey_darkgate_elex_glassworm_luca-stealer_njrat.exe

Verdict:

Malicious activity

Analysis date:

2026-06-30 07:42:23 UTC

Tags:

auto generic andromeda botnet gamarue evasion

Link:

https://app.any.run/tasks/5026504e-ee7d-4c5b-819c-60c9128a2d15

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72458/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a43733d86bc95245bfad4f6

Tags:

vmdetect

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Connection attempt

Deleting a recently created file

Creating a process with a hidden window

Searching for the window

Using the Windows Management Instrumentation requests

Launching a tool to kill processes

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm anti-vm anti-vm base64 crypto evasive expand hacktool keylogger lolbin microsoft_visual_cc packed reconnaissance

Link:

https://www.filescan.io/uploads/6a4372fd8f1420223406261c/reports/424bed88-9fa4-43f9-b00b-ba99898e16b6/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/aac8e8b0ae4e24a49302b2279cb60025d98694d281e46be2ef6fc23cc9ccf673

Verdict:

Unknown

File Type:

exe x32

Link:

https://opentip.kaspersky.com/aac8e8b0ae4e24a49302b2279cb60025d98694d281e46be2ef6fc23cc9ccf673/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9ed90b8b-f429-4b94-8a07-1d0b6f4934b3

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1935416

Signature

Accesses sensitive object manager directories (likely to detect virtual machines)

Antivirus / Scanner detection for submitted sample

Contain functionality to detect virtual machines

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to infect the boot sector

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/aac8e8b0ae4e24a49302b2279cb60025d98694d281e46be2ef6fc23cc9ccf673

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout SFX 7z Win 32 Exe x86

Link:

https://app.malva.re/file/d21c8560e55514e9c50b46f50cd04d65

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aac8e8b0ae4e24a49302b2279cb60025d98694d281e46be2ef6fc23cc9ccf673/

Verdict:

Malicious

Threat:

Family.ANDROMEDA

Link:

https://tip.neiki.dev/file/aac8e8b0ae4e24a49302b2279cb60025d98694d281e46be2ef6fc23cc9ccf673

Threat name:

Win32.Hacktool.KMSActivator

Status:

Suspicious

First seen:

2026-05-31 03:48:13 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 36 (52.78%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vleormfojyskjeycwitzznqaexmynfgsqhsgxyxpn7bdzsom6zzq._file

Verdict:

malicious

Label(s):

unc_loader_089

40ff49194227b67044cd908f885cc45c9ec8af8c4c0c45be8829291018a1a23c

508d6290ba00f0ecc532e7fe6deac1ac2f71d0a85c2c70dd533118935c7230f1

713a67c4051e3ec6be2c2fb0dcd3edcaf8297aa382fc93e1273811c43050bce2

934f8bc6e5ba0b294b6351a8abb9f523b17ff578a56f0eb7c361150bf17f771b

c17be8c5c5f60b1dd635283d0ee54346d9424f8cf12219e6a9d28c092e975584

ca4fef768aa2cd5657f8cc8a44b950c00793c1ea50d6f8c1fef78d22f18258df

error

+ 46 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/260630-jh25psh16t/

Behaviour

Checks SCSI registry key(s)

Enumerates system info in registry

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Checks for VirtualBox DLLs, possible anti-VM trick

Loads dropped DLL

Unpacked files

SH256 hash:

aac8e8b0ae4e24a49302b2279cb60025d98694d281e46be2ef6fc23cc9ccf673

MD5 hash:

d21c8560e55514e9c50b46f50cd04d65

SHA1 hash:

b1363727177760c8568fe90749b166f24bd06343

Link:

https://www.unpac.me/results/f40c4d53-e038-4f3e-8ce3-e07fe2f4eeeb/

SH256 hash:

d4bf851a4af33553c48a7545dffa8a6b76cf7fcae624a0f79a58d599c75edaf5

MD5 hash:

178523d40cab8c9443fb279c92de7b05

SHA1 hash:

9a05e6c1d6b7b743ce46de2e1c561fbd3d9184e7

Link:

https://www.unpac.me/results/f40c4d53-e038-4f3e-8ce3-e07fe2f4eeeb/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/aac8e8b0ae4e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aac8e8b0ae4e24a49302b2279cb60025d98694d281e46be2ef6fc23cc9ccf673

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	Check_Dlls Create hunting rule

Rule name:	Check_Wine Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxProductID Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox product IDs

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.