MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b23e7c88614b6db904199fdf2bb464b0f84598c69ad1917f99ff278dfaed00bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b23e7c88614b6db904199fdf2bb464b0f84598c69ad1917f99ff278dfaed00bc
SHA3-384 hash:	a76f14c6875a2e4447c3fa79b563940bdfa3470b8c7f3bdb7d81b0c3b64dd0625e07fb1c9d9a782ca957045df92fc632
SHA1 hash:	a65f575b707f98d0d878c17fd929c27441eea826
MD5 hash:	03005bc9241360671269feeffd0f56ed
humanhash:	massachusetts-black-fish-island
File name:	QuarkPC_V6.7.2.809.exe
Download:	download sample
File size:	89'178'530 bytes
First seen:	2026-05-25 05:00:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6323d82b808d068b6ab4eaefb7c2594a
ssdeep	1572864:lMhwn73BkXJXfC3wRnc7sGSr0jWvIdr0a+XT3qOsB+2GPGMQ3pO:my73BmjrIOIMXOpv5O
TLSH	T11018D082B29656F6E0B7F17085F5972B9575BC108B3091CB7AA83F2A0F323D06B35716
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	c4a8b2a2b2baa29a
Reporter	Ling
Tags:	dllHijack exe gh0st HEUR:Trojan.Win32.DLLhijack.gen

CNGaoLing

HEUR:Trojan.Win32.DLLhijack.gen

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

183

Origin country :

US

Vendor Threat Intelligence

ACCE MurmurHash3_128x64 Patchwork_Spyder_Downloader PyInstaller

Details

Link:

https://research.acce.ciphertechsolutions.com/results/04c4784a-0d60-45ea-897d-528bc7784809/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

_b23e7c88614b6db904199fdf2bb464b0f84598c69ad1917f99ff278dfaed00bc

Verdict:

No threats detected

Analysis date:

2026-05-25 05:05:12 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/66d49089-a545-425a-b9ad-bed2794cf7bd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a13d7c35d76862ef9479503

Tags:

dropper cobalt virus blic

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for synchronization primitives

Creating a process from a recently created file

Creating a window

Creating a file in the Program Files subdirectories

Searching for the window

Сreating synchronization primitives

DNS request

Creating a file

Connection attempt

Sending an HTTP GET request

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug base64 crypto explorer fingerprint fingerprint installer installer installer-heuristic lolbin microsoft_visual_cc msiexec obfuscated overlay packed packed reconnaissance regsvr32 runonce xor-pe

Link:

https://www.filescan.io/uploads/6a13d7b7efbd399b39cc07d9/reports/038fa93d-2356-48e4-9350-b40d82fdf666/overview

Hybrid Analysis Malware_

Verdict:

Malicious

Labled as:

Malware_

Link:

https://www.hybrid-analysis.com/sample/b23e7c88614b6db904199fdf2bb464b0f84598c69ad1917f99ff278dfaed00bc

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-05-24T22:36:00Z UTC

Last seen:

2026-05-27T00:32:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Win32.DLLhijack.gen Backdoor.Win32.Xkcp.awb Backdoor.Win32.GGCode.sb

Link:

https://opentip.kaspersky.com/b23e7c88614b6db904199fdf2bb464b0f84598c69ad1917f99ff278dfaed00bc/results?tab=lookup

Nucleon Malprob Susipicious

Score:

52%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/b23e7c88614b6db904199fdf2bb464b0f84598c69ad1917f99ff278dfaed00bc

CERT.PL MWDB

Gathering data

Neiki Backdoor.Win32.Xkcp

Verdict:

Malicious

Threat:

Backdoor.Win32.Xkcp

Link:

https://tip.neiki.dev/file/b23e7c88614b6db904199fdf2bb464b0f84598c69ad1917f99ff278dfaed00bc

ReversingLabs TitaniumCloud Win64.Trojan.Egairtigado

Threat name:

Win64.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-25 04:20:27 UTC

File Type:

PE+ (Exe)

Extracted files:

1589

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wi7hzcdbjnw3sbazt7psxndewd4elgggtlizc74z74ty36xnac6a._file

Threatray fatalrat

Verdict:

malicious

Label(s):

fatalrat

Alert

Create hunting rule

Similar samples:

error

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery upx

Link:

https://tria.ge/reports/260525-fnygxsev9v/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

UPX packed file

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.