MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbb9e176f2b2ee95cba7861b58e04f807cbd4718d0e408bd95b1875ef328c672. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dbb9e176f2b2ee95cba7861b58e04f807cbd4718d0e408bd95b1875ef328c672
SHA3-384 hash:	3c136b2f590e511d39bf625c61f2561be4d3ad38c737ddeb2a3b00c16e16aa1b3b349a640283c0529ad6bd4182ca4442
SHA1 hash:	6f79d09c82f680de9e206fe7130e58a910fd8764
MD5 hash:	02478c1608c0c674b9ee032a74f088eb
humanhash:	solar-massachusetts-carbon-montana
File name:	file
Download:	download sample
File size:	2'947'072 bytes
First seen:	2026-08-04 04:44:51 UTC
Last seen:	2026-08-04 05:01:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f5bec796b7b3c2932293afa8281cdeed
ssdeep	49152:BgH90dxAEsVnaZkJxRhXozc0beuE8CyUU/1gv82MoBlGkMDUpa93ls:KKxAbsQtXwc0b1EzzU6k2MoPGk1Cl
TLSH	T1D6D5239969F36D71D432C7B29FA3F0BEB16977801B61CE87BA8C74108E225945C3A371
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Bitsight
Tags:	424e51f31d68f573a4621aaede8044aa dropped-by-Remus exe

Bitsight

url: http://192.162.199.246/pb7Ulzhaae3xpSNrEvJH5yqqyMyIbnNF/9z7BGnRGpgs8cZv7.exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

155

Origin country :

US

Vendor Threat Intelligence

ACCE VMProtect_Packer_PE

Details

Link:

https://research.acce.ciphertechsolutions.com/results/aa60a5ed-4daa-418d-aacc-e5d0873bedc4/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-08-04 04:57:36 UTC

Tags:

etherhiding

Link:

https://app.any.run/tasks/a608de32-3290-48f3-bec4-f3bba7fb7fcb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/78722/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.63326864.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a716e695ab7943135dc661f/reports/dc92e57b-c99c-46f7-be0c-cfbd89934674/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/dbb9e176f2b2ee95cba7861b58e04f807cbd4718d0e408bd95b1875ef328c672

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

exe x64

First seen:

2026-08-04T02:25:00Z UTC

Last seen:

2026-08-05T02:20:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dbb9e176f2b2ee95cba7861b58e04f807cbd4718d0e408bd95b1875ef328c672/results?tab=lookup

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1fefcff0-8702-42b1-bd06-e053d0505e0a

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/dbb9e176f2b2ee95cba7861b58e04f807cbd4718d0e408bd95b1875ef328c672

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/02478c1608c0c674b9ee032a74f088eb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dbb9e176f2b2ee95cba7861b58e04f807cbd4718d0e408bd95b1875ef328c672/

ReversingLabs TitaniumCloud Win64.Malware.Heuristic

Threat name:

Win64.Malware.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-04 04:45:37 UTC

File Type:

PE+ (Exe)

AV detection:

13 of 36 (36.11%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3o46c5xswlxjls5hqynvrycpqb6l2ryy2dsarpmvwgdv54ziyzza._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260804-fdn6hav1dw/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Deletes itself

Executes dropped EXE

UnpacMe

Unpacked files

SH256 hash:

dbb9e176f2b2ee95cba7861b58e04f807cbd4718d0e408bd95b1875ef328c672

MD5 hash:

02478c1608c0c674b9ee032a74f088eb

SHA1 hash:

6f79d09c82f680de9e206fe7130e58a910fd8764

Link:

https://www.unpac.me/results/6110d23f-d124-46d7-a4e0-64678c6f7c66/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/dbb9e176f2b2ee95cba7861b58e04f807cbd4718d0e408bd95b1875ef328c672

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe dbb9e176f2b2ee95cba7861b58e04f807cbd4718d0e408bd95b1875ef328c672

(this sample)

  

Dropped by

Remus

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/78722/

  

URLhaus

https://urlhaus.abuse.ch/url/3894881/