🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bee097d480a36db3d6a929679d227e04408e6d29ca2b62718a1bb366406b36c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 17


Intelligence 17 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bee097d480a36db3d6a929679d227e04408e6d29ca2b62718a1bb366406b36c4
SHA3-384 hash: 5b7a9bffb4ae56fe1f6e91325b8c469f2d54dd06b5c22497407af95fd5740bc505c794c5dbe12cf488cf112b430dc2e9
SHA1 hash: 39c728d8bf65e3363d7e5cab261d875cdfd27371
MD5 hash: fb2a233d370c61221f512df3c564cf97
humanhash: timing-white-leopard-nitrogen
File name:bee097d480a36db3d6a929679d227e04408e6d29ca2b62718a1bb366406b36c4.bin
Download: download sample
File size:1'546'752 bytes
First seen:2026-11-10 11:56:17 UTC
Last seen:2026-11-10 12:49:29 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 887a6f493df81efb2f7744face8ad8ec
ssdeep 24576:Z1jbgFRfct64BXGqFEnPX7LJ4lNBny6uzASR7hP0:Z6FRfct2DtiytUA
TLSH T195653B03E7E5CEEAC896A73991CB2719F774FC6017639ADB531052212E537D98E3AB00
TrID 56.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
22.4% (.EXE) Win64 Executable (generic) (6522/11/2)
6.9% (.EXE) OS/2 Executable (generic) (2029/13)
6.8% (.EXE) Generic Win/DOS Executable (2002/3)
6.8% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter kernelv0id
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
134
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-10 16:15:34 UTC
Tags:
evasion auto-sch-xml auto-reg auto-sch amsi-bypass
Link:
https://app.any.run/tasks/2e37eb62-00f3-4f06-b848-d0c15d2f5fe6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99067/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af3069d463538821bc39a70
Tags:
infosteal autorun malex
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Creating a file in the system32 subdirectories
Modifying a system file
Deleting a recently created file
Creating a file in the Windows subdirectories
Creating synchronization primitives
Creating a window
Modifying an executable file
Changing a file
Sending a custom TCP request
Your mouse was active while VM was running
Enabling the 'hidden' option for recently created files
Creating a file in the system32 directory
Restart of the analyzed sample
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a file
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Searching for the window
Creating a service
Launching a service
Deleting volume shadow copies
Creating a file in the mass storage device
Preventing system recovery
Blocking a possibility to launch for the Windows registry editor (regedit.exe)
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching a tool to kill processes
Enabling autorun for a service
Blocking the Windows Defender launch
Encrypting user's files
Enabling threat expansion on mass storage devices
Enabling autorun by creating a file
Adding an exclusion to Microsoft Defender
Rewriting of the hard drive's master boot record
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-security atbroker crypto evasive explorer fingerprint hacktool lolbin masquerade mingw netsh overlay ransomware regedit schtasks
Link:
https://www.filescan.io/uploads/6af306a2a87017375985c024/reports/775fa20e-be93-49b0-9ffe-dd52a32201b9/overview
Verdict:
Malicious
Labled as:
Capa_reference_SQL_statements
Link:
https://www.hybrid-analysis.com/sample/bee097d480a36db3d6a929679d227e04408e6d29ca2b62718a1bb366406b36c4
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-03T16:34:00Z UTC
Last seen:
2026-10-31T12:58:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bee097d480a36db3d6a929679d227e04408e6d29ca2b62718a1bb366406b36c4/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/458d4ab5-1bd6-486e-aeb5-cbf0b925ee5d
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2003291
Signature
Accesses sensitive object manager directories (likely to detect virtual machines)
Antivirus / Scanner detection for submitted sample
Contains functionality to infect the boot sector
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Deletes shadow drive data (may be related to ransomware)
Disable Task Manager(disabletaskmgr)
Disables the Windows registry editor (regedit)
Disables the Windows task manager (taskmgr)
Disables Windows Defender (via service or powershell)
Drops PE files with benign system names
Excessive usage of taskkill to terminate processes
Infects the boot sector of the hard disk
Infects the VBR (Volume Boot Record) of the hard disk
May disable shadow drive data (uses vssadmin)
Modifies existing user documents (likely ransomware behavior)
Modifies the windows firewall
Modifies Windows Defender protection settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Invoke-Obfuscation Via Stdin
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: Suspicious New Service Creation
Suspicious powershell command line found
Uses bcdedit to modify the Windows boot settings
Uses schtasks.exe or at.exe to add and modify task schedules
Uses taskkill to terminate AV processes
Writes directly to the primary disk partition (DR0)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2003291 Sample: brgE1Q0YS3.exe Startdate: 10/11/2026 Architecture: WINDOWS Score: 100 89 mr-b01.tm-azurefd.net 2->89 91 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->91 93 Antivirus / Scanner detection for submitted sample 2->93 95 Multi AV Scanner detection for dropped file 2->95 97 Multi AV Scanner detection for submitted file 2->97 99 8 other signatures 2->99 9 brgE1Q0YS3.exe 8 9 2->9         started        13 brgE1Q0YS3.exe 2->13         started        15 brgE1Q0YS3.exe 2->15         started        17 3 other processes 2->17 signatures3 process4 file5 73 C:\Windows\System32\regedit.exe, PE32+ 9->73 dropped 75 C:\Windows\System32\powershell.exe, PE32+ 9->75 dropped 77 C:\Windows\System32\explorer.exe, PE32+ 9->77 dropped 81 7 other files (6 malicious) 9->81 dropped 113 Uses taskkill to terminate AV processes 9->113 115 Suspicious powershell command line found 9->115 117 Writes directly to the primary disk partition (DR0) 9->117 129 13 other signatures 9->129 19 cmd.exe 1 9->19         started        22 cmd.exe 9->22         started        24 cmd.exe 9->24         started        30 24 other processes 9->30 79 \Device\Harddisk0\DR0, DOS/MBR 13->79 dropped 119 Infects the VBR (Volume Boot Record) of the hard disk 13->119 121 Creates autostart registry keys with suspicious names 13->121 123 Creates multiple autostart registry keys 13->123 125 Excessive usage of taskkill to terminate processes 13->125 26 cmd.exe 13->26         started        28 cmd.exe 13->28         started        33 25 other processes 13->33 127 Deletes shadow drive data (may be related to ransomware) 15->127 36 5 other processes 15->36 38 2 other processes 17->38 signatures6 process7 dnsIp8 101 May disable shadow drive data (uses vssadmin) 19->101 103 Deletes shadow drive data (may be related to ransomware) 19->103 105 Uses bcdedit to modify the Windows boot settings 19->105 45 3 other processes 19->45 40 vssadmin.exe 22->40         started        43 conhost.exe 22->43         started        47 5 other processes 24->47 49 2 other processes 26->49 51 4 other processes 28->51 83 C:\ProgramData\Microsoft\...\Report.wer, Unicode 30->83 dropped 53 36 other processes 30->53 87 mr-b01.tm-azurefd.net 150.171.109.145, 443, 49722, 49731 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 33->87 85 C:\ProgramData\Microsoft\...\Report.wer, Unicode 33->85 dropped 107 Accesses sensitive object manager directories (likely to detect virtual machines) 33->107 55 38 other processes 33->55 109 Excessive usage of taskkill to terminate processes 36->109 57 4 other processes 36->57 file9 signatures10 process11 signatures12 111 Deletes shadow drive data (may be related to ransomware) 40->111 59 Conhost.exe 51->59         started        61 Conhost.exe 51->61         started        63 Conhost.exe 53->63         started        65 Conhost.exe 55->65         started        67 Conhost.exe 55->67         started        69 Conhost.exe 55->69         started        71 2 other processes 55->71 process13
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/fb2a233d370c61221f512df3c564cf97
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bee097d480a36db3d6a929679d227e04408e6d29ca2b62718a1bb366406b36c4/
Threat name:
Win64.Trojan.Malex
Create hunting rule
Status:
Malicious
First seen:
2026-10-03 20:11:00 UTC
File Type:
PE+ (Exe)
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3qjpveaunw3hvvjfftz2it6arai43jjzivwe4mkdozwmqdlg3ca._file
Verdict:
malicious
Label(s):
GenericRansomware
Create hunting rule
Link:
https://reports.threatray.com/07b17b1f-57cb-438a-8957-344ce7466850
Result
Malware family:
n/a
Score:
  10/10
Tags:
bootkit defense_evasion evasion execution impact persistence ransomware trojan
Link:
https://tria.ge/reports/261110-n4rcjshx6j/
Behaviour
Interacts with shadow copies
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry key
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Executes a command shell one-liner
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Drops desktop.ini file(s)
Indicator Removal: File Deletion
Writes to the Master Boot Record (MBR)
Checks computer location settings
Creates new service(s)
Disables RegEdit via registry modification
Disables Task Manager via registry modification
Disables cmd.exe use via registry modification
Disables one or more Microsoft Defender components
Sets service image path in registry
Deletes shadow copies
Modifies boot configuration data using bcdedit
Modifies Windows Defender DisableAntiSpyware settings
Malware Family:
n/a
Verdict:
Malicious
Tags:
rat evasion ransomware privilege_escalation
YARA:
ConventionEngine_Anomaly_NulledOut Toolmark_PhysicalDrive shadow_copy_deletion WMI_strings INDICATOR_SUSPICIOUS_GENRansomware Toolmark_PhysicalDrive_Catchall_Unsigned DeletesVssShadowCopy INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Antivirus_strings Disable_Defender CreateService CreateMediaAutorunFile Powershell AutorunKey CreateRegistryEntryUsingBatch
Link:
https://app.threat.zone/submission/9bad5ec6-49f8-4862-8692-55b4e1127c12
Malware Family:
malex
Create hunting rule
Malicious:
True
Tags:
file-overlay exe 64bit
Link:
https://intel.virussign.com/intelligence/file/bee097d480a36db3d6a929679d227e04408e6d29ca2b62718a1bb366406b36c4
Unpacked files
SH256 hash:
bee097d480a36db3d6a929679d227e04408e6d29ca2b62718a1bb366406b36c4
MD5 hash:
fb2a233d370c61221f512df3c564cf97
SHA1 hash:
39c728d8bf65e3363d7e5cab261d875cdfd27371
Detections:
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Link:
https://www.unpac.me/results/2ae69c00-9538-465f-ac1f-06d7bdf8e3da/
Malware family:
MEMZ
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bee097d480a3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bee097d480a36db3d6a929679d227e04408e6d29ca2b62718a1bb366406b36c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Author:ditekSHen
Description:Detects command variations typically used by ransomware
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SEH__v4
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:VIGIA_Generic_e19713b9
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:a28cc975-b162-4e5b-8741-c4f4eae18255 - file 0c342290ca4d6e0e8cd357ebf63c69436e9f8b32687fbd556d0be2e962ff2cd3.exe
Reference:https://vigia.bisite.es/
Rule name:VIGIA_SalatStealer_e7f7c88c
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:SalatStealer detection using an observed build artifact or paired host-process indicators with build corroboration
Reference:https://vigia.bisite.es/
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/99067/

Comments