MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RaspberryRobin

Vendor detections: 18

Intelligence 18 IOCs YARA 14 File information Comments

SHA256 hash:	d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d
SHA3-384 hash:	18e7a31d6351d1b2d55114feb7410299b19a2985856578417834fe03f35764b69c85f8926cf322d5cc284f97589d6e7e
SHA1 hash:	b67d01ef6dce5d2b36175b82a98c8431879bd151
MD5 hash:	72efd05c4a0117643365c18ac8de7aff
humanhash:	earth-minnesota-muppet-dakota
File name:	task_354.exe
Download:	download sample
Signature	RaspberryRobin Create hunting rule
File size:	2'297'856 bytes
First seen:	2026-10-31 23:44:13 UTC
Last seen:	2026-10-31 23:44:25 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	e2b0240584d94019fcdab28910b42b16 (1 x RaspberryRobin)
ssdeep	49152:xOSGeRfUXpRP9IT6z+YocKhqPeGiZ4/CHdd1IKxD6:wRP9I6DocKQPLiKKHzCKh
TLSH	T102B5F17EDF89939AC19411FA8C78E758F44D8DC08E0961C5CFE049E2C1AE308B569BDB
TrID	32.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 28.9% (.EXE) Win32 Executable (generic) (4504/4/1) 13.0% (.EXE) OS/2 Executable (generic) (2029/13) 12.8% (.EXE) Generic Win/DOS Executable (2002/3) 12.8% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	aachum
Tags:	13-143-132-84 91-92-43-45 93-152-213-215 exe RaspberryRobin

iamaachum

C2:
93.152.213.215
91.92.43.45
13.143.132.84

Intelligence

File Origin

# of uploads :

# of downloads :

199

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-31 23:49:08 UTC

Tags:

auto-reg golang ims-api generic telegram raspberryrobin

Link:

https://app.any.run/tasks/ef1125c4-22e3-4e00-9403-dcc582cda094

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/96434/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen5.36326.18237.20163.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae67d98b121dd519dcf1956

Tags:

shell virus hype

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating synchronization primitives

Creating a file

Creating a process from a recently created file

Creating a process with a hidden window

Searching for synchronization primitives

Connection attempt

Sending a custom TCP request

Enabling autorun by creating a file

Adding an exclusion to Microsoft Defender

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

active-directory adaptive-context anti-debug crypto packed reconnaissance

Link:

https://www.filescan.io/uploads/6ae67d936ae5baa6b80b5300/reports/1376ca1e-0e3a-411b-8e90-d2e459c222c4/overview

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-29T13:12:00Z UTC

Last seen:

2026-11-01T19:34:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d/results?tab=lookup

Malware family:

Emotet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a90c1810-afda-4391-8eeb-43912d6117bf

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1995952

Signature

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Contains functionality to inject code into remote processes

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: System File Execution Location Anomaly

Suspicious powershell command line found

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE Memory-Mapped (Dump)

Link:

https://app.malva.re/file/72efd05c4a0117643365c18ac8de7aff

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2026-10-29 22:50:16 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 36 (69.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2cex5eyjb35h4dfhwkqjcp2f3eeminw4joo67cta7axegushujwq._file

Verdict:

malicious

Label(s):

Stadia

Link:

https://reports.threatray.com/be66e7c7-7a8b-43e5-bd40-6f279516b754

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261031-3rw5lagy2l/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Malware Family:

n/a

Verdict:

Suspicious

Tags:

loader evasion

YARA:

BuildCommDCBAndTimeouts

Link:

https://app.threat.zone/submission/09de5184-ab47-49af-b3d2-27b97f5e414b

Malware Family:

jaik

Malicious:

True

Tags:

corrupt spreader

Link:

https://intel.virussign.com/intelligence/file/d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d

Unpacked files

SH256 hash:

d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d

MD5 hash:

72efd05c4a0117643365c18ac8de7aff

SHA1 hash:

b67d01ef6dce5d2b36175b82a98c8431879bd151

Link:

https://www.unpac.me/results/d642610a-96c5-4a6e-95f9-85bd8a7bb39e/

SH256 hash:

cc2e2a1459dc8a896885cc8ec2325846311edd92d16b52daaaefa51be5b677b6

MD5 hash:

3576b78877f8754c79b7d45c6044ff7e

SHA1 hash:

572018fade32a75e0bb7d8076225126b3f1181b6

Link:

https://www.unpac.me/results/d642610a-96c5-4a6e-95f9-85bd8a7bb39e/

SH256 hash:

c4d37b20005b55afce3748337a35dfebc31dd8a06c808849a6c5e74e6b25d03b

MD5 hash:

e26ee32fefe1cfca2ec8bd0bfc7d4c71

SHA1 hash:

0ed361a7118ce2d755a34f368718593ea91eb2d0

Link:

https://www.unpac.me/results/d642610a-96c5-4a6e-95f9-85bd8a7bb39e/

Malware family:

RaspberryRobin

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d0897e93090e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d0897e93090efa7e0ca7b2a0913f45d908c436dc4b9def8a60f82e435247a26d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.