🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3
SHA3-384 hash: c608d2c1370b2710a9e0f31ce3b3d82efb4df99a1d792d4306ff8a4c7972bbec04b7125192d91179acdd9cf7597fc406
SHA1 hash: 2311c62879abf0ad48127d874f7713f996538f51
MD5 hash: 1f95b9326435cc40babe94d46c3d5ada
humanhash: papa-fifteen-table-utah
File name:bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3.exe
Download: download sample
File size:1'965'056 bytes
First seen:2026-09-08 01:19:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b5a3c83ef75b81f8d1977a162569446a
ssdeep 49152:QfSVUoAwp9Vxz6oWkuQOkVP+MtTKtSTB+1FUfjxaqUN:c2Am9Vxz6nkuQOk1TKtSTBkFUfcq
TLSH T19395D061B681C036E5B152B187F99B39287CAA30073795C7BBD85E890B704E27B7E713
TrID 22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win64 Executable (generic) (6522/11/2)
17.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.7% (.EXE) Win32 Executable (generic) (4504/4/1)
7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon c1d9dccca6b8cece (5 x DarkVisionRAT, 1 x MarsStealer, 1 x Stealc)
Reporter whack_sh
Tags:exe whack.sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-08 01:25:31 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/14486dc6-2b65-4ca8-af2e-6f729300566a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/84450/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug evasive explorer fingerprint keylogger lolbin microsoft_visual_cc packed reconnaissance
Link:
https://www.filescan.io/uploads/6a9f62d65e195eea1cffce2e/reports/7509a7d6-14de-4781-bfe1-78b07a4ce83a/overview
Verdict:
Malicious
Labled as:
Malware_
Link:
https://www.hybrid-analysis.com/sample/bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3
Verdict:
Unknown
File Type:
exe x32
Link:
https://opentip.kaspersky.com/bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/03fb1315-88c3-4a94-ae1a-1f14b85de047
Result
Threat name:
n/a
Detection:
suspicious
Classification:
phis.bank.spyw.evad
Score:
30 / 100
Link:
https://www.joesandbox.com/analysis/1969698
Signature
Creates a COM Internet Explorer object
Modifies Internet Explorer zone settings
Modifies Internet Explorer zonemap settings
Overwrites Mozilla Firefox settings
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1969698 Sample: vbYiqXpKul.exe Startdate: 08/09/2026 Architecture: WINDOWS Score: 30 33 mr-z01.tm-azurefd.net 2->33 35 edgecdn-embza6g8cacagcbn.z01.azurefd.net 2->35 37 4 other IPs or domains 2->37 6 vbYiqXpKul.exe 19 33 2->6         started        11 iexplore.exe 65 405 2->11         started        process3 dnsIp4 45 192.168.60.10, 8080 unknown unknown 6->45 23 C:\Users\user\AppData\Roaming\...\user.js, ASCII 6->23 dropped 25 C:\Users\user\AppData\Local\...\Preferences_1, JSON 6->25 dropped 27 C:\Users\user\AppData\Local\...\HnwUACAtl.dll, PE32 6->27 dropped 29 7 other files (none is malicious) 6->29 dropped 47 Overwrites Mozilla Firefox settings 6->47 49 Modifies Internet Explorer zone settings 6->49 51 Tries to harvest and steal browser information (history, passwords, etc) 6->51 53 2 other signatures 6->53 13 EzAdminSetting.exe 57 4 6->13         started        16 EzRun.exe 12 6->16         started        18 iexplore.exe 257 11->18         started        21 iexplore.exe 67 11->21         started        file5 signatures6 process7 dnsIp8 31 C:\Windows\SysWOW64\HnwUACAtl.dll (copy), PE32 13->31 dropped 39 part-0013.t-0009.fb-t-msedge.net 13.107.253.41, 443, 49748, 49749 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 18->39 41 mr-z01.tm-azurefd.net 150.171.109.66, 443, 49750, 49751 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 18->41 43 e13678.dscg.akamaiedge.net 23.197.170.102, 443, 49730, 49745 AKAMAI-AS-AkamaiTechnologiesIncUS United States 18->43 file9
Score:
89%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7jmszdzsdkvpwtltclror2v7dwc6t4yek2lf2fijyvmh6yyu2rq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
adware discovery persistence ransomware spyware stealer
Link:
https://tria.ge/reports/260908-bp5keabj6v/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3
MD5 hash:
1f95b9326435cc40babe94d46c3d5ada
SHA1 hash:
2311c62879abf0ad48127d874f7713f996538f51
Link:
https://www.unpac.me/results/6147cd42-75f9-4165-bc46-45df9d2fbf88/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:CredRaptor
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FormhookB
Create hunting rule
Author:kevoreilly
Description:Formbook Anti-hook Bypass
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe bfd2c9647990d557da6b9897174755f8ec2f4f9822b4b2e8a84e2ac3fb18a6a3

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/84450/

Comments