MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 14


Intelligence 14 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2
SHA3-384 hash: 9b03969712b653589e9e2d34338f3cb9471e1727b8f9e77291ccfe08ad537fec957a019b08520e66d310a40ce27977be
SHA1 hash: 0f09a1154d3cd95aee0867beaff1cc58115e130b
MD5 hash: 00d70132c377e3bd1a76331f30f29336
humanhash: green-pasta-alabama-mirror
File name:00d70132c377e3bd1a76331f30f29336.exe
Download: download sample
File size:7'876'184 bytes
First seen:2025-11-16 16:55:06 UTC
Last seen:2025-12-26 08:10:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e8ac1646024d52d1534a88da2e8037cd (8 x HijackLoader, 7 x OffLoader, 7 x Tofsee)
ssdeep 98304:BDbcKtmZHjtnqqwEbN5BjnfraeB5BXp8xozMs3m/lH3fy:BDbVtRqXbN5BrNBjp8Wz3UH36
Threatray 177 similar samples on MalwareBazaar
TLSH T13F860213A24E6F3EE47F463559729A40453FAE606C1A8FE3D6E40D4CFE290601E6EE47
TrID 60.0% (.EXE) Inno Setup installer (107240/4/30)
23.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
5.8% (.EXE) Win64 Executable (generic) (10522/11/4)
3.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
93
# of downloads :
73
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-11-15 21:18:45 UTC
Tags:
drayn stealer upx loader
Link:
https://app.any.run/tasks/6684d32f-d1ef-4842-aa58-f360cc224e3d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38369/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691a020ebdb0ec3a9dc266ee
Tags:
shellcode dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Restart of the analyzed sample
Creating a process with a hidden window
Creating a file
Moving a recently created file
Searching for the window
Using the Windows Management Instrumentation requests
Enabling the 'hidden' option for recently created files
DNS request
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
embarcadero_delphi expand expired-cert fingerprint inno installer installer installer-heuristic invalid-signature lolbin overlay packed signed
Link:
https://www.filescan.io/uploads/691a02098c51fc143c6eacc6/reports/2307dc32-9dcf-4bdc-acfc-d9a64dc6727b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-14T10:54:00Z UTC
Last seen:
2025-11-18T05:43:00Z UTC
Hits:
~100
Detections:
VHO:Trojan-Banker.Win32.ClipBanker.gen Trojan-Banker.Win32.ClipBanker.sba Trojan.Win32.Shellcode.sb Trojan.Win32.Shellcode.hwa
Link:
https://opentip.kaspersky.com/c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d3724919-0b99-450f-b658-678ec06e98b9
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1814926
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Searches for specific processes (likely to inject)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1814926 Sample: 3oihsJ6tPM.exe Startdate: 16/11/2025 Architecture: WINDOWS Score: 100 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for dropped file 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected Clipboard Hijacker 2->57 10 3oihsJ6tPM.exe 2 2->10         started        14 FnHotkeyUtility.exe 2->14         started        16 FnHotkeyUtility.exe 1 2->16         started        18 6 other processes 2->18 process3 file4 41 C:\Users\user\AppData\...\3oihsJ6tPM.tmp, PE32 10->41 dropped 61 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->61 20 3oihsJ6tPM.tmp 3 5 10->20         started        63 Injects code into the Windows Explorer (explorer.exe) 14->63 65 Writes to foreign memory regions 14->65 67 Allocates memory in foreign processes 14->67 69 2 other signatures 14->69 signatures5 process6 file7 35 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 20->35 dropped 37 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 20->37 dropped 59 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 20->59 24 3oihsJ6tPM.exe 2 20->24         started        signatures8 process9 file10 39 C:\Users\user\AppData\...\3oihsJ6tPM.tmp, PE32 24->39 dropped 27 3oihsJ6tPM.tmp 5 11 24->27         started        process11 file12 43 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 27->43 dropped 45 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 27->45 dropped 47 C:\ProgramData\...\vcruntime140_1.dll (copy), PE32+ 27->47 dropped 49 11 other malicious files 27->49 dropped 30 FnHotkeyUtility.exe 501 27->30         started        process13 signatures14 71 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 30->71 73 Injects code into the Windows Explorer (explorer.exe) 30->73 75 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 30->75 77 7 other signatures 30->77 33 explorer.exe 22 1 30->33 injected process15
Score:
79%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/00d70132c377e3bd1a76331f30f29336
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2/
Verdict:
Malicious
Threat:
VHO:Trojan-Banker.Win32.ClipBanker
Link:
https://tip.neiki.dev/file/c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yizfbzreukysovirgepn422see2ndbyxuey7efvcnihbufxintba._file
Verdict:
malicious
Label(s):
unc_loader_073
Create hunting rule
Similar samples:
0b586f16ba08538d8779a08b19004993f2bad1aa936ef2e75899c24133309357
1cf0208ca043a5259145a2e90f0f2093a805df30d2fff66ffcea21c7096ee5d6
2dbee2aec305103a2ad3fbd4e56c8973e138c30b7fb349c0d6ecd38ddc421aaf
47c3a31ab04b76ddbaef87cc0447fdddf6c15aa5159eb4d41b064d73988488c3
779696f4bf969ef9da50b98c884bc149a601847c5ca3b854bb2fd6909040462c
956d607b88f263303037375a1c5e631ac644d447ba1452adfa905656820b66f6
95e4f2e823be17ac9131c2375cc70fde0ef0c7ea5acbee34e359d5094408284f
adf118b20cee8c1934614b22d36d206725a123cb87f7476c14f8242710f1e24e
b82478e796a34845419bf7c88ad2727684db48a6e719ec5fe7a1086f8c70def5
error
f58fcc5d3c9be3261305a5309b2055f0ac098ddb58d8e8731252f00c5d44fd43
+ 167 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/251116-vfe3ya1jbq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Executes dropped EXE
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/cfc5e29f-bde4-4b87-ba6a-bc27e243179a
Unpacked files
SH256 hash:
c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2
MD5 hash:
00d70132c377e3bd1a76331f30f29336
SHA1 hash:
0f09a1154d3cd95aee0867beaff1cc58115e130b
Link:
https://www.unpac.me/results/105666b7-3334-4dee-9423-41f88f138c98/
SH256 hash:
3b3ddbd41b779dd41a3f148c986daa5c1063906590827d63803d522ef27bc175
MD5 hash:
88cb7e76f58947f5c8260f9a63f0a88f
SHA1 hash:
caf66fec93ba95f887434d7aeab2a6a4e28b7553
Link:
https://www.unpac.me/results/105666b7-3334-4dee-9423-41f88f138c98/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe c23250e624a2b1275511311ede6b522134d18717a131f216a26a0e1a16e86cc2

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/38369/
  
URLhaus
https://urlhaus.abuse.ch/url/3709973/
  
Delivery method
Distributed via web download

Comments