MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 14 File information Comments

SHA256 hash:	d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6
SHA3-384 hash:	fc60c628c26ff3d150f16e9d2f356b0fcd3d21596368d412c1d84552bc680765f3df6e91ee90c70f7ced0e3ba793899e
SHA1 hash:	e57b1bd8f6321842b7bb905c38dc0974e03d6a1d
MD5 hash:	a726011b629c83a1dfe9002b6180431c
humanhash:	leopard-east-robert-black
File name:	d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6.exe
Download:	download sample
File size:	2'396'160 bytes
First seen:	2026-10-17 13:22:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'361 x AgentTesla, 20'867 x Formbook, 12'418 x SnakeKeylogger)
ssdeep	24576:P/fee3MVs3xWm3Be6cKKGBWbeS5x3R962U2emqraL+ShB7C3SX1pAoRDsl7Jfj:FcI3Be6cjeW62CRJ3SX1pAoRDsldfj
TLSH	T172B5D02F33D04526C4BB4771A424AB5AD2A9EC0BF717A71DA80ED5883DB139BDC046B7
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	418686b2d4f0c8e8
Reporter	Tuxxin
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

190

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-17 13:37:45 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/35833ba2-93a9-4937-8803-3c3e024458a9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92379/

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad37695f4e17c78f716391a

Tags:

dropper virus micro

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm base64 cmdkey cscript explorer fingerprint lolbin msiexec obfuscated packed pnputil reconnaissance regsvr32 rundll32 runonce vbnet wscript

Link:

https://www.filescan.io/uploads/6ad3768d8dd1e45013279e36/reports/b19f8015-3de6-4bca-8ee5-848e9391248f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6

Verdict:

Clean

File Type:

exe x32

First seen:

2026-10-17T01:31:00Z UTC

Last seen:

2026-10-19T08:51:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/b4a54894-3de7-477e-959c-04a39a3bc780

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1988391

Signature

Found potential dummy code loops (likely to delay analysis)

Joe Sandbox ML detected suspicious sample

Behaviour

Behavior Graph:

Download SVG

Score:

18%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6

Verdict:

inconclusive

YARA:

8 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.16 T1059.001 Win 32 Exe x86

Link:

https://app.malva.re/file/a726011b629c83a1dfe9002b6180431c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2mqlblghsidmj55h5k5gqk4o6xgxed5pomsmypqa7tujz6jdslla._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery persistence

Link:

https://tria.ge/reports/261017-qmd21agt5y/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Unpacked files

SH256 hash:

d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6

MD5 hash:

a726011b629c83a1dfe9002b6180431c

SHA1 hash:

e57b1bd8f6321842b7bb905c38dc0974e03d6a1d

Link:

https://www.unpac.me/results/47f59a6c-ae56-455e-94d7-1169ba5789c3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	Malware_PE_NET_KoiLoader Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects Koi Loader .NET executables packed with Confuser featuring specific mutex, assembly metadata, and unmanaged DLL imports

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_Scheduled_Tasks_Create_From_Susp_Dir Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory

Rule name:	SUSP_Script_PowerShell_Hidden_Launcher Create hunting rule
Author:	Marjoriefort
Description:	Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:	Veille fraicheur 2026-09-14 / cluster misses web

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe d320b0acc79206c4f7a7eaba682b8ef5cd720faf7324cc3e00fce89cf92392d6

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/92379/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample