MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403
SHA3-384 hash: b3e73f2ae42040564298c9a4197df8436d3eae10ddf4c36cd58983912dcc2a38cada7b48747c1ba9b7cde9bda0e9c55b
SHA1 hash: 8ccc66d6596f24715d8355eb381c5e570e3747e7
MD5 hash: 87d952d8264edfa9a293ba8c1789d602
humanhash: east-bacon-connecticut-delta
File name:c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403
Download: download sample
File size:1'450'616 bytes
First seen:2025-09-26 19:11:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3108acec89b16aa7a72a1153efab954c
ssdeep 24576:tKmWrILs24wTq9z0K/u9uUKlhjEG1ohDhwdGmJl4dSaWuPDyZ7wpvcqYhtJ2p:tKmWrILs24wTq9z0K/u9uZhIG1ohDh6c
Threatray 1 similar samples on MalwareBazaar
TLSH T160655AA3EF9101AAE5358434C9BF175BB63AF04D4361A7EF2A9426382E137D44F35B84
TrID 37.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
24.0% (.EXE) Win64 Executable (generic) (10522/11/4)
12.6% (.FON) Windows Font (5545/9/1)
11.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter SquiblydooBlog
Tags:exe signed

Code Signing Certificate

Organisation:HCCO Retail Ltd.
Issuer:Microsoft ID Verified CS EOC CA 02
Algorithm:sha384WithRSAEncryption
Valid from:2025-09-23T11:23:16Z
Valid to:2025-09-26T11:23:16Z
Serial number: 3300046d2ca79d945d76add4fe000000046d2c
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 2b710b212e22d0db2a51724c79545bed19abc76bdaadea22a96df04eab26082e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
libxsse.dll
Verdict:
No threats detected
Analysis date:
2025-09-25 01:01:51 UTC
Tags:
upx pecompact
Link:
https://app.any.run/tasks/7f6050d4-d635-4da4-84b8-b18563e5d780

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29191/
Detection(s):
PUA.Win.Tool.HRSword-10025943-0
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d6e562fb8bc5050e4f14aa
Tags:
ransomware shellcode coinminer autoit
Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
Running batch commands
Launching a process
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autoit cmd explorer lolbin microsoft_visual_cc mshta obfuscated packed packed packer_detected peloader signed threat wscript
Link:
https://www.filescan.io/uploads/68d6e56074e5a28989953f88/reports/a3950ee2-36e2-44f4-b1b9-57d6c0080671/overview
Verdict:
Suspicious
Labled as:
Malware_51.0
Link:
https://www.hybrid-analysis.com/sample/c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403
Verdict:
Clean
File Type:
dll x64
Link:
https://opentip.kaspersky.com/c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2c37efa4-3c25-4e84-b8b7-b25ea2f052e0
Score:
19%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403
Verdict:
inconclusive
YARA:
12 match(es)
Tags:
.Net CAB:COMPRESSION:NONE Executable Html PDB Path PE (Portable Executable) PE File Layout SFX 7z Win 64 Exe x64
Link:
https://app.malva.re/file/87d952d8264edfa9a293ba8c1789d602
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403
Threat name:
Win64.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2025-09-24 17:04:47 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
2 of 24 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yzsubpdsnluzn7oio2az4qonycxuxwyjflfrn3k257qddi7saqbq._file
Verdict:
malicious
Label(s):
supper
Create hunting rule
Similar samples:
c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403
error
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/250926-xwkdpss1cx/
Verdict:
Unknown
Tags:
cryptojacking coinminer
YARA:
CoinMiner_Strings
Link:
https://app.threat.zone/submission/826fd520-0674-4c88-8790-3c43af64f742
Unpacked files
SH256 hash:
c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403
MD5 hash:
87d952d8264edfa9a293ba8c1789d602
SHA1 hash:
8ccc66d6596f24715d8355eb381c5e570e3747e7
Link:
https://www.unpac.me/results/8831bd21-8504-4060-a463-5b8eacb0cd52/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c66540bc726ae996fdc876819e41cdc0af4bdb092acb16ed5aefe031a3f20403

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CoinMiner_Strings
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects mining pool protocol string in Executable
Reference:https://minergate.com/faq/what-pool-address
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:golang
Create hunting rule
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:iso_lnk
Create hunting rule
Author:tdawg
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/29191/

Comments