MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3
SHA3-384 hash: da7ced406f8cfb44c165114aa7a4f228bdb02aac555e97bd7fe89eb70498f82e9237b1b7d05f6b5ad5ccfef4d8e89a12
SHA1 hash: d8c73fb40810868b0456cbd757a060cb767a85f6
MD5 hash: 8601f915eb7e11eb6e0c14cc332952d2
humanhash: johnny-item-crazy-texas
File name:upd_helper.dll
Download: download sample
File size:4'483'024 bytes
First seen:2026-07-27 10:12:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 75cdd659f17f4eea75d2b0927fc62a6f
ssdeep 49152:HnoeRzV0A6Nrb/TivO90d7HjmAFd4A64nsfJ3CGD11ix1dn5gu69nprojwvHSOMd:IzA6x351mwPg
TLSH T111264B4AEC6100B7D29B227A7DB61CA47174780D6F2153D3B548E3B439723E86DF83A9
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 10f0c8f0f0ecf010
Reporter burger
Tags:exe signed

Code Signing Certificate

Organisation:Print to PDF
Issuer:Print to PDF
Algorithm:sha512WithRSAEncryption
Valid from:2026-07-26T22:45:35Z
Valid to:2027-07-26T22:55:36Z
Serial number: 68a8046cc2c4ddae4348e0ad11c1e294
Thumbprint Algorithm:SHA256
Thumbprint: 80cf711f0e53097537305829634c7e8ba767e23c906558ea662e1b9b8124aa42
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-07-27 10:16:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d63c3c7b-1685-41b8-9d64-beb182e4ba63

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76400/
Detection(s):
SecuriteInfo.com.Variant.Yogi.32166.76471527.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm crypto fingerprint golang masquerade mingw overlay packed signed
Link:
https://www.filescan.io/uploads/6a672f191baa46a4c3e17edf/reports/a06bc214-a681-4d9a-985b-b8ac76a71819/overview
Verdict:
Malicious
Labled as:
Yogi.Generic
Link:
https://www.hybrid-analysis.com/sample/b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3
Verdict:
Malicious
File Type:
dll x64
First seen:
2026-07-27T03:19:00Z UTC
Last seen:
2026-07-27T06:36:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/3fc2df95-8205-4468-9cbd-1942ff5c306f
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1948263
Signature
AI detected suspicious PE / MSI digital signature
Antivirus / Scanner detection for submitted sample
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1948263 Sample: upd_helper.dll.dll Startdate: 27/07/2026 Architecture: WINDOWS Score: 72 22 Antivirus / Scanner detection for submitted sample 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 AI detected suspicious PE / MSI digital signature 2->26 28 Joe Sandbox ML detected suspicious sample 2->28 7 loaddll64.exe 1 2->7         started        process3 signatures4 32 Potentially malicious time measurement code found 7->32 10 rundll32.exe 1 7->10         started        13 cmd.exe 1 7->13         started        15 rundll32.exe 1 7->15         started        17 10 other processes 7->17 process5 signatures6 34 Hides threads from debuggers 10->34 36 Potentially malicious time measurement code found 10->36 19 rundll32.exe 1 13->19         started        process7 signatures8 30 Hides threads from debuggers 19->30
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/8601f915eb7e11eb6e0c14cc332952d2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3/
Threat name:
Win64.Trojan.DllHijack
Create hunting rule
Status:
Malicious
First seen:
2026-07-27 08:09:28 UTC
File Type:
PE+ (Dll)
Extracted files:
7
AV detection:
14 of 36 (38.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xhpnkgipph7utxvbdsvo5s7woix7apc4lzlhj3u2j4brg46djprq._file
Verdict:
malicious
Label(s):
RevStealer
Create hunting rule
Link:
https://reports.threatray.com/a48ae2f9-82c9-4bb2-94eb-706e510647c3
Similar samples:
0fcbfd68e60437a99e8192343ddfd5399bc34cbd152064813bf998dc7575c3d9
163467ce16de4b7d52b2cba24fb9e11fa3631798ee7788a1dff601e3b297bd50
29c4b7c79b4ce38c539388dabcf85ae257981cd735c6a1abcb293c31f14ca392
8a3ef0ee8c3fc64a05925bb43b9d3b476e1ce598df7722ff14eae8114e7e9ff0
9bcef984f276a90a906971d4372b4be6bfea191d2517f84fb335c15a1b07166a
b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3
db281eccea7165538fb5cceebd9fa9f338dd435cddba4c6bc00ad335fea29456
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/260727-l8t8wszzax/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Unpacked files
SH256 hash:
b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3
MD5 hash:
8601f915eb7e11eb6e0c14cc332952d2
SHA1 hash:
d8c73fb40810868b0456cbd757a060cb767a85f6
Link:
https://www.unpac.me/results/e95378a2-d16c-427f-af7b-21b0b0e83d68/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.88
Link:
https://yomi.yoroi.company/submissions/b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:RemusStealer_GoPayload
Create hunting rule
Author:burger
Description:Detects RemusStealer Go-compiled payload
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/76400/

Comments