MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d67d1628ff5ea924c25c8056446a8143e1171fab7e30dddb24aca3255dad8817. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d67d1628ff5ea924c25c8056446a8143e1171fab7e30dddb24aca3255dad8817
SHA3-384 hash: a2c60315b50efe55a1fc533e6142c286ca0caba4c0925e0a730f8518b03636ceea64a743816579bea3f592954aad3bb2
SHA1 hash: 2f341a7ef5bffd91765dfadff060fe01367e2464
MD5 hash: 1855a44a5f41a14ffdb2360d24af837e
humanhash: river-one-artist-idaho
File name:Refund.exe
Download: download sample
File size:4'579'688 bytes
First seen:2025-11-18 22:02:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 657e40fb09b2c5e277b865a7cf2b8089 (6 x AsyncRAT, 4 x Arechclient2, 3 x DanaBot)
ssdeep 98304:AKaAh0nxrqD1gNcbqi417MQOXkFCrkDr1hDEu2UZUnB2f60CUsco:Dlax+D1gqbZS7MQO0vLDEVUZD60CUy
TLSH T1322612B1659120BBD6FD2DF3E960C2303D6FA6143B488DAA8ECCAC0D78755D169B7306
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter smica83
Tags:exe signed

Code Signing Certificate

Organisation:Hamilton Vision and Eye Care, LLC
Issuer:Microsoft ID Verified CS EOC CA 01
Algorithm:sha384WithRSAEncryption
Valid from:2025-11-15T11:44:09Z
Valid to:2025-11-18T11:44:09Z
Serial number: 3300054397ac0f8252829d630f000000054397
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 739c22809921d8ecd148c5a1a837267d3cd6138e4044d53cde24a29ecb925df6
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Refund.exe
Verdict:
Malicious activity
Analysis date:
2025-11-18 22:04:31 UTC
Tags:
hijackloader loader antivm auto generic auto-startup stealer arechclient2 backdoor rat delphi
Link:
https://app.any.run/tasks/1e3ee627-25cb-4a5e-8caa-82062405acd0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38619/
Detection(s):
SecuriteInfo.com.Trojan.Siggen31.4764.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691ced2bbdb0ec3a9dc33af8
Tags:
vmdetect dropper virus smtp
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Creating a window
DNS request
Connection attempt
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context crypto expand expired-cert fingerprint installer installer installer-heuristic lolbin microsoft_visual_cc overlay runonce short-lived-cert signed
Link:
https://www.filescan.io/uploads/691ced28d7c81eabf165e05a/reports/0c5eb15d-2a41-4bd8-8d6f-5afd0bee5a0b/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d67d1628ff5ea924c25c8056446a8143e1171fab7e30dddb24aca3255dad8817
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-18T18:38:00Z UTC
Last seen:
2025-11-20T07:11:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Dropper.Win32.Agent.gen
Link:
https://opentip.kaspersky.com/d67d1628ff5ea924c25c8056446a8143e1171fab7e30dddb24aca3255dad8817/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b6e575fd-97a1-4fa4-8089-656d3902d5cb
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
23 / 100
Link:
https://www.joesandbox.com/analysis/1816546
Signature
Initial sample is a PE file and has a suspicious name
Behaviour
Behavior Graph:
Download SVG
Score:
47%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/d67d1628ff5ea924c25c8056446a8143e1171fab7e30dddb24aca3255dad8817
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d67d1628ff5ea924c25c8056446a8143e1171fab7e30dddb24aca3255dad8817/
Verdict:
Malicious
Threat:
Trojan-Dropper.Win32.Agent
Link:
https://tip.neiki.dev/file/d67d1628ff5ea924c25c8056446a8143e1171fab7e30dddb24aca3255dad8817
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2z6rmkh7l2usjqs4qblei2ubipqroh5lpyyn3wzevsrskxnnralq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
discovery
Link:
https://tria.ge/reports/251118-1yg8xacl2x/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/caf4d6a4-ba07-41e0-91bc-daaf5a3a7148
Unpacked files
SH256 hash:
d67d1628ff5ea924c25c8056446a8143e1171fab7e30dddb24aca3255dad8817
MD5 hash:
1855a44a5f41a14ffdb2360d24af837e
SHA1 hash:
2f341a7ef5bffd91765dfadff060fe01367e2464
Link:
https://www.unpac.me/results/bf5353dc-cb0d-4b99-9ddc-90055517191f/
SH256 hash:
099796b9eaaa3bea40ed7893669a05a73978f4b46fd770397fc692ea28b1bf59
MD5 hash:
fb02d252d2a00b024451ef79eaea84d0
SHA1 hash:
aa8f65d5bb425220a6a305aabca3c73f15a5fb51
Link:
https://www.unpac.me/results/bf5353dc-cb0d-4b99-9ddc-90055517191f/
SH256 hash:
6fc5b04669217e875b6c57258fc74a554cda9b27fd1af16213535ac7845bd838
MD5 hash:
9cf086c2676b04c82fd83caf19df52b3
SHA1 hash:
d3099d9a7ad8003c555d988bd3bcaaf6ee0d211a
Link:
https://www.unpac.me/results/bf5353dc-cb0d-4b99-9ddc-90055517191f/
SH256 hash:
83e49330a7571e336ef863401c4034d464b772bde3a2effb809d2335e675337e
MD5 hash:
7a4e06c76e90dec6bd218ee1349caee2
SHA1 hash:
8410996f29228a9b4410941c172c4af4d401f626
Link:
https://www.unpac.me/results/bf5353dc-cb0d-4b99-9ddc-90055517191f/
SH256 hash:
aba66259d7e1449fc236b4831a5aadab25e9b6902664a89d23babf54f421ffe8
MD5 hash:
b880740f5b01c3e81a19c2ab359af252
SHA1 hash:
07dfa8cf502d3c54b823f791eda344373a57cec1
Link:
https://www.unpac.me/results/bf5353dc-cb0d-4b99-9ddc-90055517191f/
SH256 hash:
c6bb5d4f853e5d6ef86deb2656346324c7253297720b9b3fcc22790783532590
MD5 hash:
7463755ab64e76b7cc25678bcc441571
SHA1 hash:
3f21323c4f15ac5f2d57462a9383b65f6daa8d89
Link:
https://www.unpac.me/results/bf5353dc-cb0d-4b99-9ddc-90055517191f/
SH256 hash:
eb58474cd910eb61330ab42122d69c101280f382b83f593fbc7d1ac9df14c9b9
MD5 hash:
c82502c4e2c26c970616cbf8c81742c4
SHA1 hash:
2d14813aabf32c2055f4f31755bd6ce4e4ab0fc9
Link:
https://www.unpac.me/results/bf5353dc-cb0d-4b99-9ddc-90055517191f/
SH256 hash:
fb44a831e929567fdb4f581a34c39e5026e9a8411ed0bcb7314a5af936c93ff2
MD5 hash:
587eb6a5d9f1d7519ad13fcf168aa655
SHA1 hash:
becf8fd070e019ae5c0e24bb69f5d9964cab41b4
Link:
https://www.unpac.me/results/bf5353dc-cb0d-4b99-9ddc-90055517191f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d67d1628ff5ea924c25c8056446a8143e1171fab7e30dddb24aca3255dad8817

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/38619/

Comments