MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8b976fc785eaa95fb3087baed16edbd390084e0733e86a66647feeb51a36889. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8b976fc785eaa95fb3087baed16edbd390084e0733e86a66647feeb51a36889
SHA3-384 hash: f1c8cacd05848de09a09f8a1a819cb2ca48e42006b05d285732fc8b08366422cdff814fc5f70ea4fdbada2653946eaa2
SHA1 hash: 86fdf5fc70c1076f365e5231df4f32a17e239bec
MD5 hash: 98eaf0abbd30dd9eb5ef9bba29891643
humanhash: montana-high-december-coffee
File name:陨神之剑X登录器.exe
Download: download sample
File size:23'932'556 bytes
First seen:2025-08-17 01:01:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 432fc55f13f2f44d1365d832cb8bcac4
ssdeep 393216:x8FQAjCmoXVwwsG9LEhTQXQ3VwwsG9LEhBMGXc6S8TCwqmn2nsooM1LGyc5y/OdW:x8FQA+XVwwrKkQ3VwwrKMSIOqmn2QMtP
TLSH T1B0373380A118BD69EF50B03608AD9352F5161DD0A09D6A0F6FE6BD5B333DA835732C6F
TrID 48.1% (.EXE) Win32 EXE PECompact compressed (v2.x) (59069/9/14)
33.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon c7cf6525a5a555d5
Reporter GDHJDSYDH1
Tags:exe infostealer phishing trojan

Intelligence

File Origin
# of uploads :
1
# of downloads :
550
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
X.exe
Verdict:
Malicious activity
Analysis date:
2025-08-17 00:11:32 UTC
Tags:
xor-url generic delphi
Link:
https://app.any.run/tasks/236dd508-3f86-4307-9a40-f51f754e10b3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/21743/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a11e358fd55a79c5281ed8
Tags:
phishing virus encpk blic
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
datper microsoft_visual_cc obfuscated overlay packed packed packed pecompact zero
Link:
https://www.filescan.io/uploads/68a129faa4bdac9f5b99f8f0/reports/2258bfda-03cc-4a81-844d-01ae0aa53dc9/overview
Verdict:
Malicious
Labled as:
Generik.GLEWXRJ potentially unwanted application
Link:
https://www.hybrid-analysis.com/sample/b8b976fc785eaa95fb3087baed16edbd390084e0733e86a66647feeb51a36889
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b8b976fc785eaa95fb3087baed16edbd390084e0733e86a66647feeb51a36889
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/98eaf0abbd30dd9eb5ef9bba29891643
Gathering data
Verdict:
Malicious
Threat:
HEUR:Trojan.Win32
Link:
https://tip.neiki.dev/file/b8b976fc785eaa95fb3087baed16edbd390084e0733e86a66647feeb51a36889
Threat name:
Win32.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2025-08-16 07:44:00 UTC
File Type:
PE (Exe)
Extracted files:
214
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xc4xn7dyl2vjl6zqq65o2fxnxu4qbbhaom7injtgi77owundnceq._file
Verdict:
malicious
Label(s):
chinajmransomware
Create hunting rule
Similar samples:
error
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250817-bdke4a1zb1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/88c9d3a9-7c7c-4675-892b-a2932255b2f8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b8b976fc785eaa95fb3087baed16edbd390084e0733e86a66647feeb51a36889

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MALWARE_Win_Unknown_PackedLoader_01
Create hunting rule
Author:ditekShen
Description:Detects unknown loader / packer. Observed running LummaStealer
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pecompact2
Create hunting rule
Author:Kevin Falcoz
Description:PECompact
Rule name:PECompact2xxBitSumTechnologies
Create hunting rule
Author:malware-lu
Rule name:PECompactV2XBitsumTechnologies
Create hunting rule
Author:malware-lu
Rule name:PECompactv2xx
Create hunting rule
Author:malware-lu
Rule name:pe_packer_pecompact2
Create hunting rule
Author:@jstrosch
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:VMProtectStub
Create hunting rule
Author:@bartblaze
Description:Identifies VMProtect packer stub.
Rule name:Windows_Generic_Threat_da0f3cbb
Create hunting rule
Author:Elastic Security
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:without_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any url
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b8b976fc785eaa95fb3087baed16edbd390084e0733e86a66647feeb51a36889

(this sample)

anyrun
any.run
https://any.run/report/b8b976fc785eaa95fb3087baed16edbd390084e0733e86a66647feeb51a36889/236dd508-3f86-4307-9a40-f51f754e10b3
  
Link
https://cyber-fortress.com/docs/result/index.php?id=68a11e358fd55a79c5281ed8
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/21743/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play MultimediaWINMM.dll::midiStreamRestart
RAS_APIUses Remote AccessRASAPI32.dll::RasHangUpA
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegQueryValueA

Comments