MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5
SHA3-384 hash: 1f733a6f7b06326530f1be3f7069839efd31db8cd96a669966b1ad9bdbdc51cb37048633a8f0964eab017402e45d31a5
SHA1 hash: 33b07fa13472c02fdbe0ed27ad57041fcc00114c
MD5 hash: a27ff9af761982647ef383a5782652e1
humanhash: lactose-earth-lake-winter
File name:victim.dll
Download: download sample
File size:14'336 bytes
First seen:2026-04-28 09:38:36 UTC
Last seen:2026-04-28 09:39:11 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 2337ead6fd78ad2aae587aa37663d13c
ssdeep 192:uA93DCq5XqqH3DSHscGJPYB7AP67HnY5y82w:tD9cc3DSM1Jm17HnGJ2w
TLSH T11D52DA19F70245F6C432A3F28047C93BB6709A88C1325D59BF7A592CFA3A551A83931D
TrID 21.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
21.2% (.EXE) Win64 Executable (generic) (6522/11/2)
16.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
14.6% (.EXE) Win32 Executable (generic) (4504/4/1)
6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter smica83
Tags:dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
284
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/63850/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug cmd lolbin packed rshell
Link:
https://www.filescan.io/uploads/69f0804ec06ec088bf615d86/reports/7736df3c-96d5-4593-9abd-1a09034eb60f/overview
Verdict:
Suspicious
Labled as:
HEUR_Backdoor_Win64_RShell_gen
Link:
https://www.hybrid-analysis.com/sample/ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5
Verdict:
Malicious
File Type:
dll x32
First seen:
2026-04-25T12:12:00Z UTC
Last seen:
2026-04-30T06:36:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Win64.RShell.gen
Link:
https://opentip.kaspersky.com/ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5/results?tab=lookup
Malware family:
Kazuar
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3168657f-8fc4-4747-90a9-6f6345b85e58
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1905598
Signature
Contains functionality to start reverse TCP shell (cmd.exe)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1905598 Sample: victim.dll Startdate: 28/04/2026 Architecture: WINDOWS Score: 60 41 shed.dual-low.part-0012.t-0009.t-msedge.net 2->41 43 shed.dual-low.part-0010.t-0009.t-msedge.net 2->43 45 4 other IPs or domains 2->45 49 Multi AV Scanner detection for submitted file 2->49 10 loaddll32.exe 1 2->10         started        signatures3 process4 process5 12 rundll32.exe 10->12         started        15 cmd.exe 1 10->15         started        17 rundll32.exe 10->17         started        19 7 other processes 10->19 signatures6 51 Contains functionality to start reverse TCP shell (cmd.exe) 12->51 21 WerFault.exe 16 12->21         started        23 rundll32.exe 15->23         started        53 System process connects to network (likely due to code injection or exploit) 17->53 26 cmd.exe 19->26         started        28 WerFault.exe 1 16 19->28         started        30 WerFault.exe 16 19->30         started        process7 dnsIp8 47 154.240.183.11, 53 ALGTEL-ASDZ Algeria 23->47 32 WerFault.exe 22 18 23->32         started        35 conhost.exe 26->35         started        process9 dnsIp10 39 part-0012.t-0009.t-msedge.net 13.107.246.40, 443, 49713, 49715 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 32->39 37 conhost.exe 32->37         started        process11
Score:
80%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5/
Verdict:
Malicious
Threat:
Backdoor.Win64.RShell
Link:
https://tip.neiki.dev/file/ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-04-25 17:23:13 UTC
File Type:
PE (Dll)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjwwro5ztrrdpsmd2si2x5bcixukbv5jspfd2j7ftedsrd6yg3cq._file
Verdict:
malicious
Label(s):
purehvnc
Create hunting rule
Similar samples:
error
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery
Link:
https://tria.ge/reports/260428-lmt11abw4k/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Unexpected DNS network traffic destination
Badlisted process makes network request
Unpacked files
SH256 hash:
ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5
MD5 hash:
a27ff9af761982647ef383a5782652e1
SHA1 hash:
33b07fa13472c02fdbe0ed27ad57041fcc00114c
Link:
https://www.unpac.me/results/82800874-7766-4725-98a1-2879695aecdc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/63850/

Comments