MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8a1a859adecefdec0e57d65371f792ed8b9440e5a27f363a0dcf8375addbfd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b8a1a859adecefdec0e57d65371f792ed8b9440e5a27f363a0dcf8375addbfd9
SHA3-384 hash:	f531a98ee4f6e424d7a4ab9b083428554ab255388e11bd27de8b6662b5fd1363404a97b61c18f14e8b8304baa6e985dc
SHA1 hash:	ea9798758e44b9cbdc3c24ea0d85fb14a9826179
MD5 hash:	c9381c8e97cb994c5bd01b503f31ed35
humanhash:	neptune-fanta-single-gee
File name:	file
Download:	download sample
File size:	79'192'816 bytes
First seen:	2026-09-25 21:06:27 UTC
Last seen:	2026-09-26 01:51:29 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a604b4697f94922aff3add61321029b3
ssdeep	786432:sbiIVYV7FsKUXTjdJyFV1OH0n5fj5P14Sn7V:sgVFsLGFVHZHZ7V
TLSH	T10A08AE15E3D84B16E27FC27CC2638512E7B1B4421362D7CF0595EA992F63BC1AB36263
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	a2193c3a2cd62ba6
Reporter	Bitsight
Tags:	d52f85 dropped-by-amadey exe signed

Bitsight

url: https://github.com/serhat9611/pruva-download/releases/download/v2.0.25/PruvaAgent.exe

Intelligence

---

File Origin

# of uploads :

7

# of downloads :

173

Origin country :

US

Vendor Threat Intelligence

ACCE DotNET_ReadyToRun

Details

Link:

https://research.acce.ciphertechsolutions.com/results/0bfebecb-f5cc-4580-9596-6b30c2e04149/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-25 21:15:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/00a83bd3-1252-4cdf-9c4d-75e2ba2267a3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Moving a recently created file

Creating a process from a recently created file

Creating a process with a hidden window

DNS request

Sending a custom TCP request

Launching a service

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-debug base64 dotnet fingerprint installer-heuristic lolbin microsoft_visual_cc net obfuscated overlay reconnaissance reconnaissance signed tiger

Link:

https://www.filescan.io/uploads/6ab6e28e0f133a0f6c047838/reports/9f1b7dfe-0390-4a9a-ae3b-adbf72d45b64/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b8a1a859adecefdec0e57d65371f792ed8b9440e5a27f363a0dcf8375addbfd9

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

exe x64

Link:

https://opentip.kaspersky.com/b8a1a859adecefdec0e57d65371f792ed8b9440e5a27f363a0dcf8375addbfd9/results?tab=lookup

Nucleon Malprob Susipicious

Score:

49%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/b8a1a859adecefdec0e57d65371f792ed8b9440e5a27f363a0dcf8375addbfd9

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xcq2qwnn5tx55qhfpvstoh3zf3mlsraolit7gy5a3t4doww5x7mq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

credential_access defense_evasion discovery persistence stealer

Link:

https://tria.ge/reports/260925-zygrpsxake/

Behaviour

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Reads the TCP/IP host and domain name from the registry

System Time Discovery

Checks installed software on the system

Executes dropped EXE

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Uses browser remote debugging

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.