MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 db6ab3a42131bb24be34abbde57bdc3e3b189b7e9801a3e4e30c7304367fd507. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 11
| SHA256 hash: | db6ab3a42131bb24be34abbde57bdc3e3b189b7e9801a3e4e30c7304367fd507 |
|---|---|
| SHA3-384 hash: | 5aea8254b07a35dc3ea0e9187b7882254fc68ee13019d7d6203b62f1d791a01a0c8bc2db53640c34cf2f1a3cd12e1a6b |
| SHA1 hash: | 9e3838e5853c833ad923689f76606ab367bd85cd |
| MD5 hash: | af859b6ba2f4b4316b9afda3659d5d9b |
| humanhash: | cold-timing-blue-alaska |
| File name: | conf.exe |
| Download: | download sample |
| File size: | 6'251'008 bytes |
| First seen: | 2026-07-20 12:59:43 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'121 x AgentTesla, 20'129 x Formbook, 12'359 x SnakeKeylogger) |
| ssdeep | 98304:+FWAf2wVDrS2Zm2e/yXwRYhTex8JZbBZ6mJy8TxijMkTMQKqp7U3Sk:gWO28RZmPyXweACdZFQ8TxV+HJgSk |
| TLSH | T1185633EC3651BACDDDA3E4328DA51C60E6712EBF1317CB2B9613515AD85EDDACE000B2 |
| TrID | 20.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 19.8% (.EXE) Win64 Executable (generic) (6522/11/2) 15.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4504/4/1) 6.3% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| Reporter | Anonymous |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
187
Origin country :
CHVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
conf.exe
Verdict:
Malicious activity
Analysis date:
2026-07-20 13:09:40 UTC
Tags:
ip-check telegram exfiltration stealer golang evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
99.9%
Tags:
infosteal emotet
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the Windows subdirectories
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Creating a process from a recently created file
Creating a file in the %temp% subdirectories
Deleting a recently created file
Reading critical registry keys
Moving a file to the %temp% subdirectory
Connection attempt to an infection source
Creating a file
Stealing user critical data
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
base64 obfuscated obfuscated packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-20T10:00:00Z UTC
Last seen:
2026-07-21T07:33:00Z UTC
Hits:
~100
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
7 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.99 Win 32 Exe x86
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2026-07-20 13:01:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
19 of 38 (50.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery spyware stealer
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Looks up external IP address via web service
Executes dropped EXE
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
db6ab3a42131bb24be34abbde57bdc3e3b189b7e9801a3e4e30c7304367fd507
MD5 hash:
af859b6ba2f4b4316b9afda3659d5d9b
SHA1 hash:
9e3838e5853c833ad923689f76606ab367bd85cd
SH256 hash:
127cd97708944110d0f13bbc7b1e912cc6cf12740b16e1c15fd5562e687a83f1
MD5 hash:
846e3ab241ff5b3ed2c1ba25388293a7
SHA1 hash:
ccf20ab844b9cada75c493c1c18dc1c128a01704
SH256 hash:
54ff40c6b66f3f01d5e866e1dd9c622339ef551b8ce343ba37c541690c15fbe5
MD5 hash:
6eb5f4772c9e4ba52decc0433d229596
SHA1 hash:
e95b410cbc4d07f8ff518c7ccd0e1da62f9020c8
SH256 hash:
a8527f0424ca5cbd91643fade5fde02469908294e31f9b0b51d22f731bda3cbe
MD5 hash:
b12cf6810680d3433b314aafde294a76
SHA1 hash:
937b7b7ae39d7c85bc37edd18d0d087d4b29ae5b
SH256 hash:
03852959830e9ce5a07d0858b85ce8f803ffe39aec9267b08daba176a2f8779a
MD5 hash:
e8d0026861e557debf0656c17338087e
SHA1 hash:
dcbe88d79e6fc3a43b0ad5c268606fe50605f777
SH256 hash:
4e837412e3119684773a7e6a3598cc009aa1c946c7b95b0a2a00d703addd8c9e
MD5 hash:
77ab25e39adf62386a0c26b7cc7b88c9
SHA1 hash:
fe86c3f23c1ff39e927633bf5912558000493ec4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.