MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9b35781a6a92a99e7fd3e947882d016850f221296aae732e46bb2ec366fce10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c9b35781a6a92a99e7fd3e947882d016850f221296aae732e46bb2ec366fce10
SHA3-384 hash:	3fc143a25c82c7d7e1a47a97a325daad6190dac34e5de730bd6f1c8dc9fa5f62d3792c7ec0eb83ef216ad5b84618459e
SHA1 hash:	9017142d1b2f49f9b75313cd957de0635450a8df
MD5 hash:	72fc96a72fea8e4955f5ebd1c201e589
humanhash:	bacon-mirror-georgia-green
File name:	file
Download:	download sample
File size:	79'192'816 bytes
First seen:	2026-09-28 20:47:11 UTC
Last seen:	2026-09-30 01:08:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a604b4697f94922aff3add61321029b3
ssdeep	786432:ubiIVYM7FsKUXTjdJyFV1OH0n5fj5P14Sn7V:ugoFsLGFVHZHZ7V
TLSH	T16108AE15E3D84B16E27FC27CC2638512E7B1B4421362D7CF0595EA992F63BC1AB36263
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	a2193c3a2cd62ba6
Reporter	Bitsight
Tags:	d52f85 dropped-by-amadey exe signed

Bitsight

url: https://github.com/serhat961/pruva-download/releases/download/v2.0.26/PruvaAgent-2.0.26.exe

Intelligence

---

File Origin

# of uploads :

24

# of downloads :

181

Origin country :

US

Vendor Threat Intelligence

ACCE DotNET_ReadyToRun

Details

Link:

https://research.acce.ciphertechsolutions.com/results/58eecb63-d1b6-4179-aba2-9a49bbc35bbc/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-28 21:02:04 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/692dd453-6db3-4d7f-ab45-eaae83b1a955

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac0b9dd59bf6e2f9e92d34c

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Moving a recently created file

Creating a process from a recently created file

Creating a process with a hidden window

DNS request

Sending a custom TCP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-debug base64 dotnet fingerprint installer-heuristic lolbin microsoft_visual_cc net obfuscated overlay reconnaissance reconnaissance signed tiger

Link:

https://www.filescan.io/uploads/6abad2604771168583c80e41/reports/16d012fe-8ac5-4f8a-b60a-618d17c9685e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c9b35781a6a92a99e7fd3e947882d016850f221296aae732e46bb2ec366fce10

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x64

First seen:

2026-09-28T18:55:00Z UTC

Last seen:

2026-09-30T12:30:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c9b35781a6a92a99e7fd3e947882d016850f221296aae732e46bb2ec366fce10/results?tab=lookup

Nucleon Malprob Susipicious

Score:

49%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/c9b35781a6a92a99e7fd3e947882d016850f221296aae732e46bb2ec366fce10

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zgzvpangvevjtz75h2khrawqc2cq6iqss2voomxenozoyntpzyia._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence

Link:

https://tria.ge/reports/260928-zk4djstcrg/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Reads the TCP/IP host and domain name from the registry

Checks installed software on the system

Executes dropped EXE

Adds Run key to start application

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.