🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800
SHA3-384 hash: 3989f3ad6a1c82af068df046e9ccb7ce45a360be2a473b024a83cc257f9b9ae3e4bae86e0432116da2c4341da54cc4a2
SHA1 hash: a144b4bd4c483098994f6f9fa8e22c7a754bc032
MD5 hash: 7bcb9ca7dd15e226e60a5b949a10c100
humanhash: winter-eleven-berlin-gee
File name:d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800.exe
Download: download sample
File size:8'375'808 bytes
First seen:2026-09-28 00:11:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6bc010dffa3adde27f3c437955cba82e
ssdeep 98304:Yvmngt77kE2K5W+IahER390c8gSczbxKBI:Yvmgt7oE1o+hhER3Wc8gb8O
TLSH T1C886AD19A3E40069F42BCB38CA969733DAB1BC926735C50F0159F6461F73E918F6F226
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter whack_sh
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-28 00:21:41 UTC
Tags:
xor-url generic
Link:
https://app.any.run/tasks/6904bdfb-eeb5-4977-9f26-91696150ab80

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/89363/
Detection(s):
Win.Malware.Aotera-10060486-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto microsoft_visual_cc reconnaissance
Link:
https://www.filescan.io/uploads/6ab9b0a7933667f9e141e891/reports/68dab8a3-c774-450a-8975-90b0b8788b82/overview
Verdict:
Malicious
Labled as:
Yogi.Generic
Link:
https://www.hybrid-analysis.com/sample/d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-09-07T08:54:00Z UTC
Last seen:
2026-09-28T04:01:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/54b23b0a-48d6-4705-800b-b6dfbf71a85e
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1978708
Signature
Disables UAC (registry)
Drops password protected ZIP file
Drops PE files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Suspicious Eventlog Clear or Configuration Change
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal WLAN passwords
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Uses WMIC command to query system information (often done to detect virtual machines)
Writes many files with high entropy
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1978708 Sample: EgpD2JnPTQ.exe Startdate: 28/09/2026 Architecture: WINDOWS Score: 100 105 rdmfile.eu 2->105 107 azuresync-storage.online 2->107 109 7 other IPs or domains 2->109 123 Suricata IDS alerts for network traffic 2->123 125 Sigma detected: Capture Wi-Fi password 2->125 127 Multi AV Scanner detection for submitted file 2->127 129 6 other signatures 2->129 11 EgpD2JnPTQ.exe 89 2->11         started        16 Windows  Threat Protection.exe 2->16         started        signatures3 process4 dnsIp5 111 azuresync-storage.online 87.106.211.108, 443, 49714, 49721 IONOS-ASThisisthejointnetworkforIONOSFasthostsArsys11MailandMediaand11TelecomFormerlyknownas11InternetSEDE France 11->111 113 rdmfile.eu 104.21.37.88, 443, 49722, 49725 CLOUDFLARENET-CloudflareIncUS Canada 11->113 115 5 other IPs or domains 11->115 89 C:\Users\user\AppData\Local\...\bstbeme2.exe, PE32+ 11->89 dropped 91 C:\...\gxhYUz7K6xcbrqG5HMMio2unvCUdPofq.zip, Zip 11->91 dropped 93 C:\Users\user\AppData\...\iulnh0nh.h04.dll, PE32+ 11->93 dropped 143 Found many strings related to Crypto-Wallets (likely being stolen) 11->143 145 Uses cmd line tools excessively to alter registry or file data 11->145 147 Tries to harvest and steal browser information (history, passwords, etc) 11->147 149 3 other signatures 11->149 18 bstbeme2.exe 11->18         started        22 powershell.exe 33 11->22         started        24 powershell.exe 11->24         started        28 20 other processes 11->28 95 C:\Users\user\AppData\Local\...\python313.dll, PE32+ 16->95 dropped 97 C:\...\_pydantic_core.cp313-win_amd64.pyd, PE32+ 16->97 dropped 99 C:\Users\user\...\_brotli.cp313-win_amd64.pyd, PE32+ 16->99 dropped 101 235 other files (4 malicious) 16->101 dropped 26 Windows  Threat Protection.exe 16->26         started        file6 signatures7 process8 file9 81 C:\Users\user\AppData\Local\Temp\...\cv2.pyd, PE32+ 18->81 dropped 83 C:\Users\user\AppData\Local\...\_rust.pyd, PE32+ 18->83 dropped 85 C:\Users\user\...\_brotli.cp313-win_amd64.pyd, PE32+ 18->85 dropped 87 227 other files (4 malicious) 18->87 dropped 131 Drops PE files to the startup folder 18->131 133 Writes many files with high entropy 18->133 135 Uses WMIC command to query system information (often done to detect virtual machines) 18->135 30 bstbeme2.exe 18->30         started        137 Uses netsh to modify the Windows network and firewall settings 22->137 139 Tries to harvest and steal WLAN passwords 22->139 35 conhost.exe 22->35         started        47 2 other processes 24->47 37 cmd.exe 26->37         started        39 cmd.exe 26->39         started        41 cmd.exe 26->41         started        43 WMIC.exe 26->43         started        141 Disables UAC (registry) 28->141 45 conhost.exe 28->45         started        49 19 other processes 28->49 signatures10 process11 dnsIp12 117 gateway.discord.gg 162.159.130.234, 443, 49734 CLOUDFLARENET-CloudflareIncUS Canada 30->117 119 127.0.0.1 unknown unknown 30->119 103 C:\Users\...\Windows  Threat Protection.exe, PE32+ 30->103 dropped 121 Uses WMIC command to query system information (often done to detect virtual machines) 30->121 51 bstbeme2.exe 30->51         started        53 cmd.exe 30->53         started        55 cmd.exe 30->55         started        65 3 other processes 30->65 57 conhost.exe 37->57         started        59 conhost.exe 39->59         started        61 conhost.exe 41->61         started        63 conhost.exe 43->63         started        file13 signatures14 process15 process16 67 cmd.exe 51->67         started        69 conhost.exe 53->69         started        71 conhost.exe 55->71         started        73 conhost.exe 65->73         started        75 conhost.exe 65->75         started        77 conhost.exe 65->77         started        process17 79 conhost.exe 67->79         started       
Score:
81%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/7bcb9ca7dd15e226e60a5b949a10c100
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800/
Threat name:
Win64.Trojan.Yogi
Create hunting rule
Status:
Malicious
First seen:
2026-09-07 09:49:05 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2pzolptzbuc7yarqqzoioxo52laxxy6srgyjgnjyicsgkylc5aaa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer trojan upx
Link:
https://tria.ge/reports/260928-agsefa1amg/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Browser Information Discovery
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Network Configuration Discovery: Internet Connection Discovery
System Network Configuration Discovery: Wi-Fi Discovery
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
UPX packed file
Contacts third-party web service commonly abused for C2
Enumerates connected drives
Looks up external IP address via web service
Creates a file in the Startup directory
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Stops running service(s)
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Clears Windows event logs
UAC bypass
Unpacked files
SH256 hash:
d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800
MD5 hash:
7bcb9ca7dd15e226e60a5b949a10c100
SHA1 hash:
a144b4bd4c483098994f6f9fa8e22c7a754bc032
Link:
https://www.unpac.me/results/51491f7c-fb9e-455d-9664-8924bb6994e6/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d3f2e5be790d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe d3f2e5be790d05fc0230865c875dddd2c17be3d289b093353840a4656162e800

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/89363/

Comments