MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40
SHA3-384 hash:	0963e631bbd6b32f3c0ba62dd902962ef7d9bc5740b241bac409abf4a2a67ce6b4b0b2fbbd73b28592defe8a8508997d
SHA1 hash:	501076364590a5fa87c6f8dc6b7914a0684bb04b
MD5 hash:	b5d2d23118f60dade41c8ff146fa5844
humanhash:	fanta-winner-whiskey-michigan
File name:	ArenaCX_8316.exe
Download:	download sample
File size:	3'769'997 bytes
First seen:	2026-03-26 12:27:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	32569d67dc210c5cb9a759b08da2bdb3 (122 x RedLineStealer, 42 x DiamondFox, 37 x RaccoonStealer)
ssdeep	98304:x4N0EfhzdJUOmdETcBEKUI0ZX1CuXCGm1z8y1:x4NRfhzDAdETcQIA1CuXrE8E
TLSH	T19B0633213EFC87F5D7A02130C25C17F488B19B899D2E1C6BA344DB4E7EBDE895066B91
TrID	36.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 14.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 14.4% (.EXE) Win64 Executable (generic) (6522/11/2) 11.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	848c5454baf47474 (2'462 x Adware.Neoreklami, 101 x RedLineStealer, 62 x N-able)
Reporter	juroots
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

141

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

_c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40.exe

Verdict:

Malicious activity

Analysis date:

2026-03-26 12:27:55 UTC

Tags:

auto-reg advancedinstaller

Link:

https://app.any.run/tasks/054bc677-b3c3-4426-be17-945eb5d95c35

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Gathering data

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c52640390b99647413f31d

Tags:

shellcode virus overt

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Searching for synchronization primitives

Launching a process

Сreating synchronization primitives

Modifying a system file

Creating a file in the Windows subdirectories

Creating a file in the Program Files subdirectories

Creating a file

Creating a service

Launching a service

Creating a process from a recently created file

Loading a suspicious library

DNS request

Connection attempt

Sending a custom TCP request

Creating a process with a hidden window

Possible injection to a system process

Enabling autorun for a service

Unauthorized injection to a recently created process

Hybrid Analysis Win/malicious_confidence_60%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x32

First seen:

2026-03-26T05:05:00Z UTC

Last seen:

2026-03-28T07:41:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40/results?tab=lookup

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/ce0f9e60-0137-4052-b6fb-1b7acf9762f1

Nucleon Malprob Malware

Score:

92%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40/

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y673c662ybo3oq3kqamsxsfydxryq5ewmxhfbaigm5r4qxcubnaa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery ransomware

Link:

https://tria.ge/reports/260326-pmzs2ah19x/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Badlisted process makes network request

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UnpacMe

Unpacked files

SH256 hash:

c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40

MD5 hash:

b5d2d23118f60dade41c8ff146fa5844

SHA1 hash:

501076364590a5fa87c6f8dc6b7914a0684bb04b

Link:

https://www.unpac.me/results/249c92b6-2499-4e2d-b9ca-c87bc77c22d4/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe c7bfb17bdac05db7436a80192bc8b81de388749665ce5081066763c85c540b40

(this sample)

Cape

https://www.capesandbox.com/analysis/59366/

  

URLhaus

https://urlhaus.abuse.ch/url/3805645/

  

Delivery method

Distributed via web download