MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a
SHA3-384 hash:	496aa01294f9d3c7058bcfcd40a1628b48505885d2b318a6cc8b87f8a511ea6f6ac451251f89102720f0a4c8730f58b9
SHA1 hash:	7919f1de90367e4a79d0e3521f5e12d469014e82
MD5 hash:	707f0512d1fa15e03a5c5700bfc11d05
humanhash:	cardinal-potato-virginia-summer
File name:	dl.hta
Download:	download sample
Signature	PureRAT Alert Create hunting rule
File size:	1'073 bytes
First seen:	2026-09-07 19:04:23 UTC
Last seen:	2026-09-08 17:15:26 UTC
File type:	hta
MIME type:	text/html
ssdeep	24:exbxNwUqmMQOFkisFT8PKkTQ5kov7P4VbCq0T5y3rTZkRW:ebNwXFk7UXQ/v7Poe5y+o
TLSH	T163111277E406D6350B2294D43094D82CD4A344D680948133EA8CC8E47E2B7CCFB2C7EA
Magika	vba
Reporter	BlinkzSec
Tags:	PureRAT

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

42

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a/results/dashboard

Payload URLs

URL

File name

http://45.61.150.229:8080/hook

HTA File

Behaviour

BlacklistAPI detected

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-09-07T17:03:00Z UTC

Last seen:

2026-09-08T14:54:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a

Malva.RE Malware

Verdict:

Malware

YARA:

3 match(es)

Tags:

COM Behavior Trace DeObfuscated Html MSXML2.XMLHTTP Obfuscated Scripting.FileSystemObject SOS: 0.24 T1027 T1059 T1059.005 T1105 VBScript WScript.Shell

Link:

https://app.malva.re/file/707f0512d1fa15e03a5c5700bfc11d05

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xuu24l6m2j3f2i5oaq6tygqofzzki3irxvcjwoee5t2ol4455mva._file

Threatray PureHVNC

Verdict:

malicious

Label(s):

PureHVNC

Alert

Create hunting rule

Link:

https://reports.threatray.com/1660688c-703b-4f93-99f2-b3e08adde726

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/260907-xrm9sseq8z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

Badlisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bd29ae2fccd2765d23ae043d3c1a0e2e72a46d11bd449b3884ecf4e5f39deb2a