MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8
SHA3-384 hash: a13bb811e9cb59d0fb0cdd4ad55e10498f5c92a31d7b8c00a450819c0b6109b6f901fa9e09b4d3bfda458469907c1c7b
SHA1 hash: 3af5c9345609c31dadeff4e3aee48b108ebf04e4
MD5 hash: ab78aecf86ddfe9ebeb146698f3ce0dd
humanhash: spring-washington-sierra-quebec
File name:18 node.dll
Download: download sample
File size:815'616 bytes
First seen:2026-01-10 09:24:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fee43ee650d6f5b413585563c42430c2
ssdeep 12288:tkCqF2VZKehnx2mwrzfJhogMd/krbCyYov:trqFeZ7hngPffoLVkrV
TLSH T1E1057E1EAB5402B8D17BE275CA574D02E772B80A13716ADF03E04A951F77BE01B3E71A
TrID 43.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
27.6% (.EXE) Win64 Executable (generic) (10522/11/4)
13.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) OS/2 Executable (generic) (2029/13)
5.2% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:91-215-85-42 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
18 node.dll
Verdict:
No threats detected
Analysis date:
2026-01-10 09:24:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cf1da849-b0ca-45cf-9116-03a18838758c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/48455/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69621ad5f50945831dff9f77
Tags:
emotet virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug base64 fingerprint masquerade microsoft_visual_cc
Link:
https://www.filescan.io/uploads/69621ad107ef5fa68e83a1c5/reports/68f8c53d-a66d-46c9-a147-97fa8b10fa0e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8
Verdict:
Clean
File Type:
dll x64
First seen:
2025-12-19T12:50:00Z UTC
Last seen:
2025-12-19T12:57:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5a57d6ed-a9e2-479d-8147-df5a15cee4ac
Score:
59%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/ab78aecf86ddfe9ebeb146698f3ce0dd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y6oqi7wdkom7xlyalh5odyddt76mot73sing3l3vqvvqba4f2d4a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260110-ldbhasb15f/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ace33c86-9b62-471a-a835-b8573ebb13e2
Unpacked files
SH256 hash:
c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8
MD5 hash:
ab78aecf86ddfe9ebeb146698f3ce0dd
SHA1 hash:
3af5c9345609c31dadeff4e3aee48b108ebf04e4
Link:
https://www.unpac.me/results/110042bb-68fc-4383-9653-7bf6983c69d5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe c79d047ec35399fbaf0059fae1e0639ffcc74ffb921a6daf75856b008385d0f8

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/48455/
  
URLhaus
https://urlhaus.abuse.ch/url/3755374/
  
Delivery method
Distributed via web download

Comments