MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34
SHA3-384 hash:	83638b1ed5affc3aec62d605bd981391ea6c887a9cea11aa12317b7fe0d3cbad84b448df2b459bf3465d11546dceed8c
SHA1 hash:	a2e1c4d7d6c0b37a558055e486366b958b248e09
MD5 hash:	550d290b4d8dcb0bceca24b9bbbba5cc
humanhash:	alaska-red-whiskey-four
File name:	file
Download:	download sample
File size:	126'976 bytes
First seen:	2026-06-30 05:42:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	332b41c0ffa734bb9c9d5b037af977ac
ssdeep	3072:2wgy/Wv9dPbPVojVLbqHP99RJUd5axcpISp:22/OdztoRLUcaGp9
TLSH	T1C1C31241C1989C60CEDB67716D1FD4C21386E062E2CACBFE78D49A7BA1780F92D457E2
TrID	60.0% (.EXE) UPX compressed Win64 Executable (70117/5/12) 23.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 5.5% (.EXE) Win64 Executable (generic) (6522/11/2) 4.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.7% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	Bitsight
Tags:	c dropped-by-gcleaner exe MIX7.file UPX

Bitsight

url: http://158.94.209.95/service

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	126'976 bytes
File size (de-compressed) :	250'880 bytes
Format:	win64/pe
Unpacked file:	3f21f77ec7ded0714e22e93d2cefbedd44740a159252125d230a139cc6cc4d23

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a0535e63-078f-4631-a0e3-f033cd82abd9/

Malware family:

n/a

ID:

File name:

_c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34.exe

Verdict:

Malicious activity

Analysis date:

2026-06-30 05:47:27 UTC

Tags:

stealer upx

Link:

https://app.any.run/tasks/d3a4adbd-26ec-4e35-97b2-0d5c43862b2a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72429/

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a4357511548daf709fb2869

Tags:

phishing virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Verdict:

Malicious

Labled as:

Suspicious:Trojan.xPack.a.qobe.dll

Link:

https://www.hybrid-analysis.com/sample/c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34

Verdict:

Clean

File Type:

exe x64

First seen:

2026-06-30T01:14:00Z UTC

Last seen:

2026-06-30T03:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/678a7f85-f52b-4104-b101-2636e4891530

Score:

83%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/550d290b4d8dcb0bceca24b9bbbba5cc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-06-30 05:43:42 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ygjzg5chyhm6scgzben3it47d7dclxcuhy5laldkig5dny7d342a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

collection discovery spyware stealer upx

Link:

https://tria.ge/reports/260630-getcaafv9y/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

System Time Discovery

Drops file in Windows directory

UPX packed file

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34

MD5 hash:

550d290b4d8dcb0bceca24b9bbbba5cc

SHA1 hash:

a2e1c4d7d6c0b37a558055e486366b958b248e09

Link:

https://www.unpac.me/results/84d87576-3ed8-42ea-8ec3-a5a21cfe5993/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c193937447c1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c193937447c1d9e908d9091bb44f9f1fc625dc543e3ab02c6a41ba36e3e3df34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.