MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9
SHA3-384 hash: 92fca1e424a3b0f424a599f113bebed6b472c1af77a4e25f8671818fba4bda2030363e7f0ba4b2415e9434817211c12e
SHA1 hash: 8b7103b2c68863f41353428397ad2ff385cccc3f
MD5 hash: e4f9c51ab3cb9d3db255b70c09f25fa7
humanhash: moon-batman-maryland-oklahoma
File name:aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9
Download: download sample
File size:62'464 bytes
First seen:2026-02-04 11:38:59 UTC
Last seen:2026-02-04 12:50:58 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 1536:V4m9cFkjLh4cF5k5EIaG4YQtZGrpl07pK5cvyVul2dYjORuNK9sbCJyGS:yALScQ5yG4YWiplepK5cvyVul2dYjORx
TLSH T1CA531B592748C72DC79E4A3DF071722543B9E20A3013FBD7AE58B8DE3916B8521632F6
TrID 35.4% (.EXE) Win64 Executable (generic) (10522/11/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Anonymous
Tags:dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
145
Origin country :
EG EG
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51667/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69832fe46b1af47db72cc10b
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 hacktool
Link:
https://www.filescan.io/uploads/69832fe1930564ff3c895fcd/reports/60f90813-e1cf-4c71-8abc-492e70ead1e9/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9
Result
Gathering data
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/28cbe50e-5886-429f-81cf-952e3aff6558
Score:
18%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.22 Win 32 Exe x86
Link:
https://app.malva.re/file/e4f9c51ab3cb9d3db255b70c09f25fa7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-02-02 13:03:00 UTC
File Type:
PE (.Net Dll)
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vlg5dhlsdylmfcjqq3xr5vl5otjdm33olbcmxn6m7sa55klnuguq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260204-nsdmbagz4g/
Unpacked files
SH256 hash:
aacdd19d721e16c2893086ef1ed57d74d2366f6e5844cbb7ccfc81dea96da1a9
MD5 hash:
e4f9c51ab3cb9d3db255b70c09f25fa7
SHA1 hash:
8b7103b2c68863f41353428397ad2ff385cccc3f
Link:
https://www.unpac.me/results/06d28c00-1622-43a9-b6a7-6e53f232f761/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/51667/

Comments