🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65
SHA3-384 hash: bb9a59d278b508557556225cae14b093474675fc4a7eaab7533810208face4c5aeba32d436058a5ba2f7e65bc2b933f2
SHA1 hash: 5dc7a82e24ebbf4359fba505bd54efa25334a1e4
MD5 hash: c02941509f498b428ecb4bb31852fc81
humanhash: queen-iowa-low-single
File name:c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65.exe
Download: download sample
File size:15'958'077 bytes
First seen:2026-10-16 12:11:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash e3e80a143805ea18936c8f612e25d363 (1 x PyhtonStealer, 1 x PythonStealer)
ssdeep 393216:YwW8aLze0ZuCq6mdUSCmLwqFaxJoy14+WwoTAtn:tW8afe0gCq9qJ0VFaxmE4HwoTAtn
TLSH T158F633C8B39408EAE8EBA63DE691581A53F635520FA5C1D717F806901DB72E8FE74331
TrID 70.9% (.EXE) InstallShield setup (43053/19/16)
10.7% (.EXE) Win64 Executable (generic) (6522/11/2)
8.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.3% (.EXE) OS/2 Executable (generic) (2029/13)
3.3% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon c6c2ccc4f4e0e0f8 (50 x PythonStealer, 32 x Adware.Yogi, 29 x SVCStealer)
Reporter whack_sh
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
217
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
PyInstaller
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1450d291-039d-46bf-b7ae-1cb88c415ba7/
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
2to1ep.exe.zip
Verdict:
Malicious activity
Analysis date:
2026-10-03 18:01:38 UTC
Tags:
auto metasploit framework arch-exec python phorpiex botnet evasion solaris loader opendir generic stealer stealc nemucod github possible-phishing powershell xmrig miner screenconnect rdp rmm-tool dsys rat dcagentrmm svc remcos pastebin arcticagent asyncrat putty telegram vidar silentnet tool remote remusstealer websocket clickfix glamour acr datto tinynuke phishing rustystealer susp-powershell ip-check havoc koiloader xworm adware autoit payload action1 coinminer networm amus remus blackmoon banker cobaltstrike wannacry ransomware pyinstaller rustdesk donutloader abyssos autohotkey onyxc2 lumma hijackloader gofile njrat stealerium meterpreter rdpwrap discord redline ms-smartcard rhadamanthys salatstealer guloader etherhiding pushware deerstealer qrcode azorult bruteratel gh0st
Link:
https://app.any.run/tasks/8482db02-ca84-4a8a-8129-9503b20c62c4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/92267/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.81631432.69458323.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad21482f4e17c78f7162ab9
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
Creating a window
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug expired-cert microsoft_visual_cc overlay packed packed pyinstaller pyinstaller short-lived-cert
Link:
https://www.filescan.io/uploads/6ad214ad38ab3762f682fe19/reports/8f61fe4b-574b-46c1-a778-10d7b8ae3dec/overview
Verdict:
Suspicious
Labled as:
High_entropy
Link:
https://www.hybrid-analysis.com/sample/c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65
Verdict:
Unknown
File Type:
exe x64
Link:
https://opentip.kaspersky.com/c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8ad8e747-9308-448c-8956-4264b709f054
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1988024
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1988024 Sample: zfQpFJyRqH.exe Startdate: 16/10/2026 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 zfQpFJyRqH.exe 1001 2->6         started        process3 process4 8 zfQpFJyRqH.exe 6->8         started       
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/c02941509f498b428ecb4bb31852fc81
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-01 01:12:40 UTC
File Type:
PE+ (Exe)
Extracted files:
2237
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ydpbkp6flagbhgggusvz5uglwlaal7atzcyaokzyczvd33pzzzsq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery pyinstaller
Link:
https://tria.ge/reports/261016-pc9v9aes9z/
Behaviour
Suspicious use of WriteProcessMemory
Reads the TCP/IP host and domain name from the registry
Loads dropped DLL
Unpacked files
SH256 hash:
c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65
MD5 hash:
c02941509f498b428ecb4bb31852fc81
SHA1 hash:
5dc7a82e24ebbf4359fba505bd54efa25334a1e4
Detections:
PyInstaller
Create hunting rule
Link:
https://www.unpac.me/results/8c91c0c0-1d58-4c74-b5b9-6f9b492cb41c/
SH256 hash:
007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 hash:
8d4805f0651186046c48d3e2356623db
SHA1 hash:
18c27c000384418abcf9c88a72f3d55d83beda91
Link:
https://www.unpac.me/results/8c91c0c0-1d58-4c74-b5b9-6f9b492cb41c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe c0de153fc5580c1398c6a4ab9ed0cbb2c005fc13c8b0072b38166a3dedf9ce65

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3916472/
Cape
Cape
https://www.capesandbox.com/analysis/92267/

Comments