MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e
SHA3-384 hash:	7c634d8fc884f85c5047461e379693e10738b8f7567495bd1b36c117c9cdca72d8011673a0177c461b1e94e236cf5e10
SHA1 hash:	ed4f591c740d04d733f847bb52dd3a40b0ac0c56
MD5 hash:	604369a2b165afe786200fe70851caba
humanhash:	oklahoma-helium-connecticut-august
File name:	b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e.exe
Download:	download sample
File size:	69'120 bytes
First seen:	2026-08-12 12:53:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	91d8be4f49246c5818d6b02af88b4166
ssdeep	1536:uRbPvnj4oJLe9AeEgvGRP38HjbmJhEbWg6Hg6IW:uRLnaFHnmwcxH
TLSH	T12C63290AB35364FCC42AC1B442EBA737EA73F86606316F7F5364D2312E24D906E2DA15
TrID	45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 18.0% (.EXE) Win64 Executable (generic) (6522/11/2) 13.9% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.ICL) Windows Icons Library (generic) (2059/9) 5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	whack_sh
Tags:	exe whack.sh

Intelligence

File Origin

# of uploads :

# of downloads :

126

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-08-12 12:59:58 UTC

Tags:

barys auto-startup

Link:

https://app.any.run/tasks/c448460e-7d0c-4d94-9686-905c88640f19

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/80741/

Detection(s):

Win.Malware.Malwarex-10058597-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Enabling autorun by creating a file

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-debug crypto packed

Link:

https://www.filescan.io/uploads/6a7c6d13bb21eee86aa9bd87/reports/6f6e4766-0d74-4041-899c-ed0ad5241d29/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/aa89127f-55ce-4443-a584-fc3c565c24bb

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/604369a2b165afe786200fe70851caba

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e/

Threat name:

Win64.Trojan.Dacic

Status:

Malicious

First seen:

2026-08-12 13:11:15 UTC

File Type:

PE+ (Exe)

AV detection:

18 of 38 (47.37%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xbgl7ggdb4f3pyo4vqexv6rrovx3xqkiv27h4h7lknhn5cjzrmpa._file

Verdict:

malicious

Label(s):

DDOSBot

Link:

https://reports.threatray.com/220fbf9f-a738-4d5d-8dda-cb8f91915184

Result

Malware family:

n/a

Score:

7/10

Tags:

persistence privilege_escalation

Link:

https://tria.ge/reports/260812-p5ln5avvgv/

Behaviour

Creates a file in the Startup directory

Unpacked files

SH256 hash:

b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e

MD5 hash:

604369a2b165afe786200fe70851caba

SHA1 hash:

ed4f591c740d04d733f847bb52dd3a40b0ac0c56

Link:

https://www.unpac.me/results/c8c1082e-b48a-4f35-b820-a258768e31b3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.98

Link:

https://yomi.yoroi.company/submissions/b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.