🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5e640b7676e3ef1741d902dfb183e6129aa997d4b99a9626af9bb7c022e796f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5e640b7676e3ef1741d902dfb183e6129aa997d4b99a9626af9bb7c022e796f
SHA3-384 hash: df38db88d98f53f924dbaa3ec5c8aa8cbeec0534c39dfbd9311274d6ea4d4ee4bf20832669c6f63f14380dc2945a79b8
SHA1 hash: 3c27d9ee4620d09f923aa41003aef1dc7c2519a9
MD5 hash: f8276672855d65bf334ecd43f5747080
humanhash: illinois-item-low-jupiter
File name:gtrs_2816-10-2026.099FFBBB2FEF9D6BEBF.vhdx
Download: download sample
File size:37'748'736 bytes
First seen:2026-10-16 09:11:04 UTC
Last seen:Never
File type:vhdx VHDX
MIME type:application/octet-stream
ssdeep 98304:fwIRzlgsn45s52cdL1PzoT/1GXMvOkqGRwXSDnFKUeuNBLC+dEfgaAo:bRzGsn5ob12MEGeX0T1O+dEY7
TLSH T1FA87CF07A6F401BAC4BAD138C5678A5FE3B2BC050A31D74F5395769E2F737A09D2A321
Magika iso
Reporter smica83
Tags:vhdx

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
HU HU
File Archive Information

This file archive contains 13 file(s), sorted by their relevance:

File name:29370956-5585-47d2-ac9d-9792ba72a83a.bak
File size:26'404 bytes
SHA256 hash: 2dc700fd4aebd844e483c84e81e4556594839c29689063f238c2541c9d091626
MD5 hash: 63ab2098c72b657187ba10890d793c15
MIME type:application/octet-stream
File name:c320ee5b-3bc8-4c20-b05a-4a7f77b8cb31.chk
File size:26'411 bytes
SHA256 hash: 06c3dc06b76166b51139024a9c1f37f77b6ac3f23c0b2d5b50233143363a9e69
MD5 hash: 868b8889c579b9803e3f98e7c2fb69e0
MIME type:application/octet-stream
File name:8d6c3c21-ad04-4139-acc8-8a1206d7e709.mui
File size:31'739 bytes
SHA256 hash: 849973c9eb22e81d5042bdb9c0fd91e4d672d0fa165de2d1dd792b75cae3867f
MD5 hash: dec185a7506be1071f5881d34e834635
MIME type:application/octet-stream
File name:gtrs_2816-10-2026.exe
File size:1'130'416 bytes
SHA256 hash: 81cf4d59df869abfe5034d160090d88bc9c573e8c5daf284fd29417d48411d5b
MD5 hash: 8cf96be406d5b55912e4d79c2a533568
MIME type:application/x-dosexec
File name:c2572cf7-566d-40b6-828b-09084ece436d.dat
File size:29'889 bytes
SHA256 hash: a142760fd11e432c8625fe07e7afcfa58a51513f0958d4bf18d2be9d5a4eff41
MD5 hash: 8938f34fd52263f70c98255a8248e177
MIME type:application/octet-stream
File name:crCLIEnT.DlL
File size:5'571'072 bytes
SHA256 hash: d6b3019f3c91ecc9cd20d4bfb11c4ae42bb4390f3af40614866287e750458acd
MD5 hash: 9ca99f1eea894b9d70768ae8678cd916
MIME type:application/x-dosexec
File name:78c4d7ef-b40a-44fc-bcd5-974eff4b7b3f.bak
File size:10'567 bytes
SHA256 hash: cfb69f4a2d0fba8f54299bbe6bb8d858c2d54863fc619274e62e34a626d2e724
MD5 hash: dbeaecfc73529c072cd9f82c4fe94db8
MIME type:application/octet-stream
File name:14d84d3a-d96f-49f3-9cd0-e3d1a2bcf4ab.efi
File size:28'997 bytes
SHA256 hash: e6e3ba4d5a5c994294b6fa541a0cbaa5a30d208da025ba432d7665437ef1f17a
MD5 hash: 1cd297a6e378a3145b94cf3f87711571
MIME type:application/octet-stream
File name:48ef54f7-eeec-4b52-828c-b13161bdb8e2.p7b
File size:22'923 bytes
SHA256 hash: 0c6bb3814af768b67ce0a4eb980f928758162cf0dacceccdd9e5fab9e4e2f0f5
MD5 hash: 625de7c88b21955a2fb85633df9c5631
MIME type:application/octet-stream
File name:7e37be65-e3dc-4979-8820-945232a396c2.stl
File size:31'256 bytes
SHA256 hash: de87d68b4dea810a776c466df361b7be476f7291cffd3735f4d8f6b010aa8d1d
MD5 hash: b2d5d05383778f9668aa28469f4c969e
MIME type:application/octet-stream
File name:430fcc6b-627d-4e17-9950-207d1ecbedba.pfx
File size:19'035 bytes
SHA256 hash: b548ef1a5af19e1a780b66f4344f28bb35bdcd356fadb2c570d60cf5f7f3854c
MD5 hash: da508638a5623b4ca2250c945913ac72
MIME type:application/octet-stream
File name:odbcconf.dll
File size:24'576 bytes
SHA256 hash: 5e4f754b7c938c6ab528b68f3cc2a8ec3d3b0a38ac0a8bc634e2744dc3981206
MD5 hash: 54ab3a91ccb9a29fa53cef10ab28800b
MIME type:application/x-dosexec
File name:1fdb73fe-a372-4a75-9da4-91cac3bc5b7d.dat
File size:15'691 bytes
SHA256 hash: 04905642850209df93f769c32e48dd581b638dba19e727067a55089a551f71d3
MD5 hash: a5fe2ff0744ae319e01ee229757213d1
MIME type:application/octet-stream
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad1ea63f4e17c78f716293a
Tags:
n/a
Verdict:
Suspicious
Labled as:
Trojan.Downloader.Script
Link:
https://www.hybrid-analysis.com/sample/b5e640b7676e3ef1741d902dfb183e6129aa997d4b99a9626af9bb7c022e796f
Verdict:
Malicious
File Type:
discimage.vhdx
First seen:
2026-10-17T20:59:00Z UTC
Last seen:
2026-10-17T21:08:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b5e640b7676e3ef1741d902dfb183e6129aa997d4b99a9626af9bb7c022e796f/results?tab=lookup
Gathering data
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-16 09:11:29 UTC
File Type:
Binary (Archive)
Extracted files:
76
AV detection:
4 of 38 (10.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxtebn3hny7pc5a5saw7wgb6meu2vgl5jom2sytk7g5xyaropfxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/b5e640b7676e3ef1741d902dfb183e6129aa997d4b99a9626af9bb7c022e796f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:GenericGh0st
Create hunting rule
Author:Still
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments