MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5
SHA3-384 hash:	ffafc652c22646916445032a4edfa800c753ca1b83f2d6bd43976de47608a6217a8f10c9040398c91c56d75d8ac0c15f
SHA1 hash:	52801fde62efadf83f1d255a1da68a02a1211b88
MD5 hash:	3b27755ba200ac7eade2561628dfefbc
humanhash:	bakerloo-table-colorado-charlie
File name:	c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5.exe
Download:	download sample
File size:	2'899'456 bytes
First seen:	2026-09-01 13:42:04 UTC
Last seen:	2026-10-19 07:40:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	58f4b17816a07f7a36dd14e504d515e6
ssdeep	49152:62puUyTbXBCv/v1adr9YVx0+AWnP+vvlWHrfl+7yMif44w1bfDy7SDxeOM:62psbXBCvH+ruVxdA0KlWLfl+7yFfPaU
TLSH	T1F2D523D275F205F9D86BC7B29F86F4BD716973868B608D0BFECD18508E12694103A7B2
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Tuxxin
Tags:	exe whack.sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

162

Origin country :

HU

Vendor Threat Intelligence

ACCE VMProtect_Packer_PE

Details

Link:

https://research.acce.ciphertechsolutions.com/results/fbb100a7-9b0d-4ca1-adb6-49f6d8a6dfc4/

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

Suspicious activity

Analysis date:

2026-09-01 13:50:12 UTC

Tags:

websocket

Link:

https://app.any.run/tasks/2a9ab753-d406-4c70-954b-48c8fdad81f4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/83555/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.11697185.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac80950a11b85346e0d81cf

Tags:

click virus remo

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Creating a process from a recently created file

Creating a process with a hidden window

Connection attempt to an infection source

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Moving of the original file

Query of malicious DNS domain

Sending a TCP request to an infection source

Enabling autorun

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a96d6354011e044b653db7f/reports/70aac04b-dc02-4e97-a76e-17baadd6c7d5/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-01T09:48:00Z UTC

Last seen:

2026-09-02T23:51:00Z UTC

Hits:

~100

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Win32.Sdum.gen BSS:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5/results?tab=lookup

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5324fcdf-db9a-4437-93bc-a3824daac0d0

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/3b27755ba200ac7eade2561628dfefbc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5/

ReversingLabs TitaniumCloud Win64.Trojan.Qwexlafiba

Threat name:

Win64.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-01 13:42:24 UTC

File Type:

PE+ (Exe)

AV detection:

18 of 24 (75.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yi4g6t7mx64sc7mgw3lzmayqy4mu643hwjay6feyxvm7zuvmn22q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/260901-qzse6azeqe/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Deletes itself

Executes dropped EXE

Registers new Windows logon scripts automatically executed at logon.

UnpacMe

Unpacked files

SH256 hash:

c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5

MD5 hash:

3b27755ba200ac7eade2561628dfefbc

SHA1 hash:

52801fde62efadf83f1d255a1da68a02a1211b88

Link:

https://www.unpac.me/results/b8aa1bba-e23e-45a5-9242-d75331861298/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe c2386f4fecbfb9217d86b6d7960310c7194f7367b2418f1498bd59fcd2ac6eb5

(this sample)

  

Delivery method

Distributed via web download

  

URLhaus

https://urlhaus.abuse.ch/url/3894883/

Cape

https://www.capesandbox.com/analysis/83555/