MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bb5c45cb88abb1ca0310bc1ac8c1cb1c723bd82768f28635ffe06450803ced04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 10
| SHA256 hash: | bb5c45cb88abb1ca0310bc1ac8c1cb1c723bd82768f28635ffe06450803ced04 |
|---|---|
| SHA3-384 hash: | 89ec81fee1c16efb9b745e6179d202bc19f70292468462b45ec74f76a2e74a1a5c1837bb498c5b4fae7a904c0093af63 |
| SHA1 hash: | f13942553564b76a12b8bc3ab24ac1baa04bdcc7 |
| MD5 hash: | 418c603fdce03c3394a5fe2c354a1e49 |
| humanhash: | delaware-johnny-november-low |
| File name: | main.exe |
| Download: | download sample |
| File size: | 11'815'699 bytes |
| First seen: | 2026-04-09 14:05:09 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1e92fd54d65284238a0e3b74b2715062 (21 x Empyrean, 4 x Gh0stRAT, 4 x Telemiris) |
| ssdeep | 196608:PXNlfRuYiiLnbWJWH4Lc35IdQmRrdA6lkaycBIGpEVSE0iuKe1CeKELI4:sY5WJVwJIdQOlp9FzRqV |
| TLSH | T1C1C633A023686CF1E7ABD03E48779559D931BC1A13A5F06783B8C2AA1F2B3703D37654 |
| TrID | 33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| dhash icon | c6c2ccc4f4e0e0f8 (49 x PythonStealer, 32 x Adware.Yogi, 29 x SVCStealer) |
| Reporter |  BlinkzSec |
Intelligence
File Origin
# of uploads :
1
# of downloads :
54
Origin country :
GBVendor Threat Intelligence
Malware configuration found for:
PyInstaller
Details
PyInstaller
a compiled assembly and a Python version
Malware family:
n/a
ID:
1
File name:
_bb5c45cb88abb1ca0310bc1ac8c1cb1c723bd82768f28635ffe06450803ced04.exe
Verdict:
Suspicious activity
Analysis date:
2026-04-09 14:07:57 UTC
Tags:
discord python
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
93.3%
Tags:
installer extens virus
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
DNS request
Connection attempt
Sending a custom TCP request
Creating a window
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Verdict:
Clean
File Type:
exe x64
First seen:
2026-03-11T19:01:00Z UTC
Last seen:
2026-04-09T12:20:00Z UTC
Hits:
~10
Verdict:
Unknown
Score:
98%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Verdict:
Malicious
Threat name:
Win64.Trojan.Generic
Status:
Suspicious
First seen:
2026-04-09 14:05:46 UTC
File Type:
PE+ (Exe)
Extracted files:
817
AV detection:
14 of 38 (36.84%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
pyinstaller
Behaviour
Suspicious use of WriteProcessMemory
Contacts third-party web service commonly abused for C2
Loads dropped DLL
Unpacked files
SH256 hash:
bb5c45cb88abb1ca0310bc1ac8c1cb1c723bd82768f28635ffe06450803ced04
MD5 hash:
418c603fdce03c3394a5fe2c354a1e49
SHA1 hash:
f13942553564b76a12b8bc3ab24ac1baa04bdcc7
SH256 hash:
2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
MD5 hash:
8769adafca3a6fc6ef26f01fd31afa84
SHA1 hash:
38baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SH256 hash:
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
MD5 hash:
c17b7a4b853827f538576f4c3521c653
SHA1 hash:
6115047d02fbbad4ff32afb4ebd439f5d529485a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerException__SetConsoleCtrl |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Detect_PyInstaller |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects PyInstaller compiled executables across platforms |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | PyInstaller |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious. |
| Rule name: | TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments |
| Reference: | https://cyfare.net/ |
| Rule name: | upxHook |
|---|---|
| Author: | @r3dbU7z |
| Description: | Detect artifacts from 'upxHook' - modification of UPX packer |
| Reference: | https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe bb5c45cb88abb1ca0310bc1ac8c1cb1c723bd82768f28635ffe06450803ced04
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.