MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9dd4a002ab984533889adf80d5b6cb72609a845bdf949d76c08eab6de4d73b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	d9dd4a002ab984533889adf80d5b6cb72609a845bdf949d76c08eab6de4d73b0
SHA3-384 hash:	1ca542ed6514ae1d1ecebfcf03e4bc3d51ad52bbc43e52ddc77195b8d09cd48891be059b33aaf99c862bb69ad995465c
SHA1 hash:	505085d31116ab85eae76166a9f058bca1d9f913
MD5 hash:	bb037f48b440f3234c8972a54721752a
humanhash:	artist-jersey-blue-item
File name:	SecuriteInfo.com.Win64.MalwareX-gen.55376291
Download:	download sample
File size:	29'696 bytes
First seen:	2025-11-28 20:43:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4b2df774f65211b4962a056c4da67248
ssdeep	768:iSyJIBSNxAq1/VPRMzZhSM9og1gsNhujsCWI:ihI5o2zsa7ujUI
TLSH	T199D2D00755902B38FAFC09369F379955203EB8360FB6C398AB52545E6890443BDBCBE1
TrID	63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12) 24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.8% (.ICL) Windows Icons Library (generic) (2059/9) 1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	29'696 bytes
File size (de-compressed) :	61'952 bytes
Format:	win64/pe
Unpacked file:	369b7963a0e01cca12368d84f3417320ba606d835ec14784a8e4f1ea9f39e1b7

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

Setup.exe

Verdict:

Malicious activity

Analysis date:

2025-11-28 19:38:32 UTC

Tags:

loader auto sliver framework stealer purecrypter purelogs payload silverfox backdoor valley winos rat metastealer redline exfiltration purehvnc meduza netreactor github ta558 apt stegocampaign reverseloader valleyrat evasion phishing nanocore upx

Link:

https://app.any.run/tasks/6e2b3a50-83b0-4e79-9355-50fa6dd70af3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/41741/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.55376291.UNOFFICIAL

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=692a096b6cb1dcd577821f04

Tags:

autorun

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending a custom TCP request

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug crypto packed packed packed upx

Link:

https://www.filescan.io/uploads/692a09642cd29ea6300306bb/reports/8608ca52-c268-4af8-8255-08299b18e53b/overview

Verdict:

Malicious

Labled as:

Trojan[Ransom]/MSIL.HiddenTear

Link:

https://www.hybrid-analysis.com/sample/d9dd4a002ab984533889adf80d5b6cb72609a845bdf949d76c08eab6de4d73b0

Result

Gathering data

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-11-28T16:52:00Z UTC

Last seen:

2025-11-28T17:24:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d9dd4a002ab984533889adf80d5b6cb72609a845bdf949d76c08eab6de4d73b0/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/5bc2d745-674f-4548-8312-5c6c035f6173

Score:

92%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d9dd4a002ab984533889adf80d5b6cb72609a845bdf949d76c08eab6de4d73b0

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/bb037f48b440f3234c8972a54721752a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d9dd4a002ab984533889adf80d5b6cb72609a845bdf949d76c08eab6de4d73b0/

Threat name:

Win64.Trojan.Barys

Status:

Malicious

First seen:

2025-11-28 20:43:19 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

19 of 36 (52.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3houuabkxgcfgoejvx4a2w3mw4tatkcfxx4utv3mbdvlnxsnooya._file

Result

Malware family:

n/a

Score:

7/10

Tags:

upx

Link:

https://tria.ge/reports/251128-zhnkbawrd1/

Behaviour

UPX packed file

Drops startup file

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2d2f8c8b-e94d-43e2-8946-40bec082dd3e

Unpacked files

SH256 hash:

d9dd4a002ab984533889adf80d5b6cb72609a845bdf949d76c08eab6de4d73b0

MD5 hash:

bb037f48b440f3234c8972a54721752a

SHA1 hash:

505085d31116ab85eae76166a9f058bca1d9f913

Link:

https://www.unpac.me/results/803f8edb-63e1-4da9-b8e7-e5abc846a339/

SH256 hash:

369b7963a0e01cca12368d84f3417320ba606d835ec14784a8e4f1ea9f39e1b7

MD5 hash:

d123d9d137ede21ccefaad75886184be

SHA1 hash:

909360611feebf705cb2dabce1f5f49e170a36c1

Link:

https://www.unpac.me/results/803f8edb-63e1-4da9-b8e7-e5abc846a339/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d9dd4a002ab984533889adf80d5b6cb72609a845bdf949d76c08eab6de4d73b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.