MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c
SHA3-384 hash: 1b6b564649fa49030193c87566eeb25d0f858950cbb92a3bdd68b37b70d5343bcc414c514096dac2a8473281fb921481
SHA1 hash: d235fedc7d54abdce832f6d7d6eac23775f14ae2
MD5 hash: 9e9b115772f26251465a4b255a994e8b
humanhash: wyoming-blossom-maine-oxygen
File name:SecuriteInfo.com.Win64.MalwareX-gen.65334659
Download: download sample
File size:461'624 bytes
First seen:2025-10-23 14:16:32 UTC
Last seen:2025-10-23 16:19:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 960f68516a31e0e77f5cf8913501e514
ssdeep 6144:hOYUdl0CHeU6lnsumEGQx9RHJ4zymMZAO8cPT2zZ1mZGHibOhTd2m:A3FHe5JsALPQUAO8sT2t/iGTdr
Threatray 608 similar samples on MalwareBazaar
TLSH T118A46D36FB8058F9D357C474C25246629632B88A0720A6FB06B81725DF25EFD5F3BB24
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe signed

Code Signing Certificate

Organisation:dAHENzpJ
Issuer:dAHENzpJ
Algorithm:sha256WithRSAEncryption
Valid from:2025-10-23T02:06:03Z
Valid to:2026-10-23T02:16:03Z
Serial number: 1d42457ece7a5db2420e9f0064392177
Thumbprint Algorithm:SHA256
Thumbprint: f45302d7f694675406093469baf02ebe80b111f4f6ff0da9cd0dd3c8e917c887
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
8
# of downloads :
83
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
0_c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45.exe
Verdict:
Malicious activity
Analysis date:
2025-10-23 13:28:41 UTC
Tags:
amadey botnet stealer auto redline anti-evasion rdp loader generic gcleaner vidar autoit salatstealer ms-smartcard github deerstealer stealc rhadamanthys inno installer delphi xor-url powerview tool miner rat remcos remote telegram evasion
Link:
https://app.any.run/tasks/615c24a3-29b5-4861-89a3-a550b9eacadb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/33908/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68fa31516c859164aa6382a4
Tags:
keylog word hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Setting a global event handler
Setting a global event handler for the keyboard
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm fingerprint keylogger microsoft_visual_cc obfuscated signed threat
Link:
https://www.filescan.io/uploads/68fa39163a79800405f324bf/reports/29d1a301-db99-4675-b5c6-3f5c72022813/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-10-23T10:32:00Z UTC
Last seen:
2025-10-24T10:18:00Z UTC
Hits:
~10
Detections:
UDS:DangerousObject.Multi.Generic
Link:
https://opentip.kaspersky.com/aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6fe869cb-5164-42ce-987d-7b885c97a8b9
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/9e9b115772f26251465a4b255a994e8b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c/
Verdict:
Malicious
Threat:
Win64.Malware.Heuristic
Link:
https://tip.neiki.dev/file/aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-10-23 13:37:14 UTC
File Type:
PE+ (Exe)
Extracted files:
15
AV detection:
12 of 24 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vsq5pipb54file3gncaav6lsrnhjo3qzc74cv2vbmowt5n4cujwa._file
Verdict:
malicious
Label(s):
donut_injector
Create hunting rule
Similar samples:
08eadd57e12b933440c0b38d853ed90c2e5b0363e4301d8381c829ec53e85f9a
1d1e4a085bca8408c68e3b717f77cb667bcc0192502ecd2094a87f868aabb93a
5249882063c9eefc16d3dcf0f00ecc6a52a4e47e4c01cd044d8678b7c32bb61d
aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c
b312ad755ed2937661ef26ac8490eeb0c5b27b296faa5b325a5af424865f3bab
dfae3c8310231b314c6193d12274ef285de473ada117e66fa7fa1c7e298bd712
error
+ 598 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion
Link:
https://tria.ge/reports/251023-rlj3asew4d/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Looks for VMWare drivers on disk
Enumerates VirtualBox DLL files
Looks for VirtualBox drivers on disk
Looks for VirtualBox executables on disk
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/55139a80-9e48-4769-9de7-feb4aca5bda2
Unpacked files
SH256 hash:
aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c
MD5 hash:
9e9b115772f26251465a4b255a994e8b
SHA1 hash:
d235fedc7d54abdce832f6d7d6eac23775f14ae2
Link:
https://www.unpac.me/results/4f287249-5724-4970-a54e-5524979a70bb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aca1d7a1e1ef/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Debugger
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe aca1d7a1e1ef0a85936668800af9728b4e976e1917f82aeaa163ad3eb782a26c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3684797/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/33908/

Comments