🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lazarus


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7
SHA3-384 hash: 2e6121599c65fe076be18e9f2a2bdc357176a3c9c0d43c80bbaa0304c71a376d818dd53efd04ff11c9090ec0e7c0f283
SHA1 hash: 28978e987bc59e75ca22562924eab93355cf679e
MD5 hash: 447557d5236f1b97be0314b317ca9fff
humanhash: oklahoma-ink-oxygen-kansas
File name:TSMSISrv.dll
Download: download sample
Signature Lazarus
Create hunting rule
File size:828'416 bytes
First seen:2026-02-12 12:37:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 655221b6bcad7b5b0b9766142cbc257a (1 x Lazarus)
ssdeep 12288:oWujjXB8pkTnyDjVBRxQ1UdiG/Mclbvc/Z:oWujFl2JFQ1Udi2MKc/Z
TLSH T124053846735481A9D4678179CD43CA69EAB2BC519B1093CB23F477AF6E333E11B3A321
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon 6a2a3b1b131b9292 (1 x Lazarus)
Reporter smica83
Tags:apt exe Lazarus

Intelligence

File Origin
# of uploads :
1
# of downloads :
217
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
TSMSISrv.dll
Verdict:
No threats detected
Analysis date:
2026-02-12 12:39:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f24bef0b-cf72-450f-8924-fb3cbac0c688

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53132/
Detection(s):
Win.Trojan.Agent-1388735
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698dc9b32afa47e5c6464d5b
Tags:
nukesped
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug fingerprint masquerade microsoft_visual_cc nukesped
Link:
https://www.filescan.io/uploads/698dc9b1981ff1d38a533517/reports/b740d806-c1d3-4e97-8f82-574f58934c31/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7
Verdict:
Malicious
File Type:
dll x64
First seen:
2025-08-13T15:19:00Z UTC
Last seen:
2026-02-12T13:01:00Z UTC
Hits:
~10
Detections:
Trojan.Win64.Lazarus.ey
Link:
https://opentip.kaspersky.com/aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/fdf032cd-e5e1-4c3c-a125-c5accc209389
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1868368
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1868368 Sample: TSMSISrv.dll.exe Startdate: 12/02/2026 Architecture: WINDOWS Score: 64 23 shed.dual-low.part-0012.t-0009.t-msedge.net 2->23 25 shed.dual-low.part-0010.t-0009.t-msedge.net 2->25 27 4 other IPs or domains 2->27 31 Malicious sample detected (through community Yara rule) 2->31 33 Antivirus / Scanner detection for submitted sample 2->33 35 Multi AV Scanner detection for submitted file 2->35 8 loaddll64.exe 3 1 2->8         started        signatures3 process4 process5 10 rundll32.exe 8->10         started        12 cmd.exe 1 8->12         started        14 rundll32.exe 8->14         started        16 3 other processes 8->16 process6 18 WerFault.exe 20 16 10->18         started        21 rundll32.exe 12->21         started        dnsIp7 29 part-0010.t-0009.t-msedge.net 13.107.246.38, 443, 49737, 49739 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->29
Score:
14%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/447557d5236f1b97be0314b317ca9fff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7/
Verdict:
Malicious
Threat:
Trojan.Win64.Lazarus
Link:
https://tip.neiki.dev/file/aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7
Threat name:
Win64.Trojan.Lazarus
Create hunting rule
Status:
Malicious
First seen:
2025-06-30 17:16:03 UTC
File Type:
PE+ (Dll)
Extracted files:
105
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v3v43delcvsf27trw2fmaxrb5gsmst4dfrsairzf3bylq64vopdq._file
Verdict:
malicious
Label(s):
quanpinloader
Create hunting rule
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence privilege_escalation
Link:
https://tria.ge/reports/260212-pt4qkaaz3d/
Behaviour
Modifies registry class
Event Triggered Execution: Component Object Model Hijacking
Unpacked files
SH256 hash:
aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7
MD5 hash:
447557d5236f1b97be0314b317ca9fff
SHA1 hash:
28978e987bc59e75ca22562924eab93355cf679e
Detections:
win_quan_pin_loader_auto
Create hunting rule
Link:
https://www.unpac.me/results/7685ca4c-02ef-44b2-84f8-675437e77db0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:bumblebee_win_generic
Create hunting rule
Author:_kphi
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:win_quan_pin_loader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.quan_pin_loader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/53132/

Comments