MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd247472066bcee6dbafea80b28dfe5cb20229133ddb61a7358c694e73d787cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cd247472066bcee6dbafea80b28dfe5cb20229133ddb61a7358c694e73d787cc
SHA3-384 hash:	658a052ee228a8d57a398c397d6bfaaa4a0cbec7d9c34f66820022c7e84fa94f35e4e549861b57f4a1f327b378d97834
SHA1 hash:	4501f19eefe7c03b6041881019c79d77ace40fa6
MD5 hash:	33f046c87469c6e5d45e06b7df05c5be
humanhash:	oxygen-march-oxygen-kilo
File name:	KnSmdczXXjqIBT.exe
Download:	download sample
Signature	Grandoreiro Alert Create hunting rule
File size:	94'734'336 bytes
First seen:	2026-10-28 15:11:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	0107351eea0a096c6989e389275b292e (1 x Grandoreiro)
ssdeep	393216:HkLaY00+gBFP1CPwDvt3uFWCyOGJAh1z:Rgj
TLSH	T1D7288D02A387573DD8DE093A0676E265793B2650971FB8D357A024DC4F78DF02E3AB4A
TrID	64.6% (.EXE) Inno Setup installer (107240/4/30) 25.0% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 3.9% (.EXE) Win64 Executable (generic) (6522/11/2) 2.7% (.EXE) Win32 Executable (generic) (4504/4/1) 1.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	b3a3d3abb6b2a9a7 (1 x Grandoreiro)
Reporter	confu53
Tags:	exe Grandoreiro

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

187

Origin country :

BR

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-28 15:19:45 UTC

Tags:

installer stealer grandoreiro banker

Link:

https://app.any.run/tasks/398df5d0-66c8-4dbb-a5fd-7339fafa4ead

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae211be3a56bbccb37c0e00

Tags:

shellcode virus

FileScan.io

Gathering data

Hybrid Analysis Capa_check_for_OutputDebugString_error

Verdict:

Malicious

Labled as:

Capa_check_for_OutputDebugString_error

Link:

https://www.hybrid-analysis.com/sample/cd247472066bcee6dbafea80b28dfe5cb20229133ddb61a7358c694e73d787cc

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-28T14:28:00Z UTC

Last seen:

2026-10-28T14:46:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/cd247472066bcee6dbafea80b28dfe5cb20229133ddb61a7358c694e73d787cc/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

54 / 100

Link:

https://www.joesandbox.com/analysis/1994098

Signature

Connects to many ports of the same IP (likely port scanning)

Detected PE file pumping (to bypass AV & sandboxing)

Multi AV Scanner detection for submitted file

Potentially malicious time measurement code found

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/cd247472066bcee6dbafea80b28dfe5cb20229133ddb61a7358c694e73d787cc

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-28 15:16:41 UTC

File Type:

PE (Exe)

Extracted files:

189

AV detection:

16 of 37 (43.24%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zushi4qgnphonw5p5kalfdp6lszaekithxnwdjzvrruu446xq7ga._file

Threatray Grandoreiro

Verdict:

suspicious

Label(s):

Grandoreiro

Alert

Create hunting rule

Link:

https://reports.threatray.com/bc868fc9-2a48-4875-8e53-a320b654eab3

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/261028-sm57ladz5r/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

2284c58e773f79e42c4856a4d05bd4568d8259e202fc58399fdc7cfe74724597

Grandoreiro

exe cd247472066bcee6dbafea80b28dfe5cb20229133ddb61a7358c694e73d787cc

(this sample)

any.run

https://app.any.run/tasks/767ef8f6-7e93-4db9-b2fc-2fef0a12514a

  

Dropped by

SHA256 2284c58e773f79e42c4856a4d05bd4568d8259e202fc58399fdc7cfe74724597

  

Delivery method

Distributed via e-mail attachment