MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Intelligence 12 IOCs YARA 18 File information Comments

SHA256 hash:	ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0
SHA3-384 hash:	64b8f167675bd985abf5f72bb37717b201a9838c560db6e772fe69ec4998d2aabb4b9409eb04576cd42ac66f9e5e268d
SHA1 hash:	407a9172f0c96071b0f1f4b8f9956a630fa3ca1f
MD5 hash:	6f652deed6f96ca23fe0f4aeed084c18
humanhash:	glucose-foxtrot-zulu-utah
File name:	file
Download:	download sample
File size:	1'072'406 bytes
First seen:	2026-03-21 16:33:05 UTC
Last seen:	2026-03-22 01:19:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4e29cbd183417e9681b8a8d2108c3d5a
ssdeep	12288:kWhvoqZAH9XS1HEpjAERkUOfu2rBQafbdh9p/MCwxOZouYZ8T/geHlw8yF9nOkWP:9hTadS7gkUOfu+bXhiuC4vw8OOk8TAU
TLSH	T17E358F16A6A401BCD5B7C1B8CE668943E371784A0331AADF17D09E662F176F09A3FF11
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543

Bitsight

url: http://158.94.208.7/files/7115306239/Qub5kf3.exe

Intelligence

File Origin

# of uploads :

# of downloads :

153

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2026-03-21 16:35:29 UTC

Tags:

websocket

Link:

https://app.any.run/tasks/11bd7c83-0fa1-4fda-bc1d-0fbd65829727

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.44199396.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69bec84eaacb4c376b1282b0

Tags:

injection shell sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Connection attempt

Sending an HTTP GET request

Сreating synchronization primitives

DNS request

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug cmd crypto evasive explorer findstr fingerprint keylogger lolbin microsoft_visual_cc netsh overlay packed update wmic

Link:

https://www.filescan.io/uploads/69bec84b677ac46843a7e728/reports/e64b48a6-eae7-4794-91bd-4711de5586f4/overview

Verdict:

Malicious

Labled as:

Tedy.Generic

Link:

https://www.hybrid-analysis.com/sample/ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0

Verdict:

Malicious

File Type:

exe x64

Detections:

Trojan-PSW.Win32.Disco.sb HEUR:Trojan-PSW.Win32.Disco.gen

Link:

https://opentip.kaspersky.com/ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/49425dfc-0e19-4a65-9741-e80a1413e2ef

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0/

Verdict:

Malicious

Threat:

Trojan-PSW.Win32.Disco

Link:

https://tip.neiki.dev/file/ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0

Threat name:

Win64.Spyware.Generic

Status:

Suspicious

First seen:

2026-03-21 16:33:36 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

9 of 36 (25.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xjfs2lj6ifgjn3hx56tvzsnzgepv4p2gsj4cwbxv5umxuaqqgcya._file

Result

Malware family:

n/a

Score:

7/10

Tags:

persistence

Link:

https://tria.ge/reports/260321-t2mjgagy61/

Behaviour

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Unpacked files

SH256 hash:

ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0

MD5 hash:

6f652deed6f96ca23fe0f4aeed084c18

SHA1 hash:

407a9172f0c96071b0f1f4b8f9956a630fa3ca1f

Link:

https://www.unpac.me/results/9c0944f0-de34-48a9-9829-1b17f10d2a8a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ba4b2d2d3e414c96ecf7efa75cc9b9311f5e3f4692782b06f5ed197a021030b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_WebSocket_Base64_C2_20250726 Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects configuration strings used by malware to specify WebSocket command-and-control endpoints inside Base64-encoded data. It looks for prefixes such as '#ws://' or '#wss://' that were found in QuasarRAT configuration data.