🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b98dc5ac7cde35fd609dbd93165474a765de3d5fda7c7d4e6086cf60d27be281. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Prometei


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b98dc5ac7cde35fd609dbd93165474a765de3d5fda7c7d4e6086cf60d27be281
SHA3-384 hash: a5eef6c20dd66c6bae21de981c4e041c41ec089c6ba9de8dcbcf7b1b674382e67fad2e6e503c9327ded566e554563e59
SHA1 hash: 7184a0379556524058e83af329085ac7700ab585
MD5 hash: 6e9f3bafbfc578255273b94e5344646e
humanhash: earth-fanta-four-march
File name:b98dc5ac7cde35fd609dbd93165474a765de3d5fda7c7d4e6086cf60d27be281
Download: download sample
Signature Prometei
Create hunting rule
File size:245'859 bytes
First seen:2026-09-15 06:18:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 899ad1596f9c6642245b3fb721bae585 (31 x Prometei, 1 x Mirai)
ssdeep 3072:uaZcM3pgOPBdu/XkI8KCcMrnfaoaGmK8K7AzZIl/7Z0NWehnLCW9IPkPduwXFo3i:TWO6fPkhKCDahM90ZGyNhLCW9IMPdwi
TLSH T13134AE73A4BCEB9FDDD82F779C8B850713A62FD98890203E0D94751EFD2A5082E35616
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter GAYINT_DOT_ORG
Tags:cowrie exe honeypot Prometei

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-09-15 07:52:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/089a656f-53b3-4c21-83cc-3852ff6d3b59

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/85525/
Detection(s):
SecuriteInfo.com.BackDoor.Spy.4060.17127.12217.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Labled as:
Variadic.Prometei.Generic
Link:
https://www.hybrid-analysis.com/sample/b98dc5ac7cde35fd609dbd93165474a765de3d5fda7c7d4e6086cf60d27be281
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/87a0f935-3f36-4a72-9d6d-1d3dd58ba541
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b98dc5ac7cde35fd609dbd93165474a765de3d5fda7c7d4e6086cf60d27be281
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/6e9f3bafbfc578255273b94e5344646e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b98dc5ac7cde35fd609dbd93165474a765de3d5fda7c7d4e6086cf60d27be281/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgg4lld43y272ye5xwjrmvduu5s54pk73j6h2ttaq3hwbut34kaq._file
Verdict:
malicious
Label(s):
Prometei
Create hunting rule
Link:
https://reports.threatray.com/9e843dd3-80bc-4a1b-8e19-80bf32df7a53
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery execution
Link:
https://tria.ge/reports/260915-g3a6lsdh95/
Behaviour
Gathers system information
Runs ping.exe
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Unpacked files
SH256 hash:
b98dc5ac7cde35fd609dbd93165474a765de3d5fda7c7d4e6086cf60d27be281
MD5 hash:
6e9f3bafbfc578255273b94e5344646e
SHA1 hash:
7184a0379556524058e83af329085ac7700ab585
Link:
https://www.unpac.me/results/0fc9143e-102f-4702-8ebd-1163f626b7fd/
SH256 hash:
d8b379a84272fb113674b6a0236ef599691fba163da27db02e2cd11beac3d7de
MD5 hash:
264395e8f7270097aac360d492ea0286
SHA1 hash:
7a4c69dbc8a82c86a3b126517dcacc39f3517c5d
Link:
https://www.unpac.me/results/0fc9143e-102f-4702-8ebd-1163f626b7fd/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Prometei

Executable exe b98dc5ac7cde35fd609dbd93165474a765de3d5fda7c7d4e6086cf60d27be281

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/85525/

Comments