MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e1a3e3e0cc2e8b9476504c920ee20c9e50ef9f3270d7c4562da774dd9c990c58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 16
| SHA256 hash: | e1a3e3e0cc2e8b9476504c920ee20c9e50ef9f3270d7c4562da774dd9c990c58 |
|---|---|
| SHA3-384 hash: | 4a08178c0d2af79d4ddf0d9950941f5e781f1d5554ed76c5acc1d0b981cecf6c2687b969cedc022ed74851e9c50d93fc |
| SHA1 hash: | 0118ba6026af1769a6a46925b81a07ea41a834b3 |
| MD5 hash: | a06636d2b8aa4ce2a05d484a510f35cd |
| humanhash: | romeo-massachusetts-coffee-king |
| File name: | a06636d2b8aa4ce2a05d484a510f35cd.exe |
| Download: | download sample |
| File size: | 2'955'956 bytes |
| First seen: | 2025-11-18 06:42:29 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f6baa5eaa8231d4fe8e922a2e6d240ea (63 x CoinMiner, 22 x DCRat, 15 x LummaStealer) |
| ssdeep | 49152:IgwRqHtgSlNf25gsDf+fQazuUQvycsG2SV583WJn+1Z9a7KmU79fq10XbH1vugNc:IgwRe85gG+f6XvyfDaOWJn+MWmm9qqj6 |
| Threatray | 1'111 similar samples on MalwareBazaar |
| TLSH | T10CD5331177A391B1D48B483265ED294905DDDEAC3B1AA2CBBFEE65070DB43D0CA7E0B1 |
| TrID | 38.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 24.6% (.EXE) Win64 Executable (generic) (10522/11/4) 11.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.5% (.EXE) Win32 Executable (generic) (4504/4/1) 4.7% (.EXE) OS/2 Executable (generic) (2029/13) |
| Magika | pebin |
| Reporter |  abuse_ch |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
80
Origin country :
SEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a06636d2b8aa4ce2a05d484a510f35cd.exe
Verdict:
Malicious activity
Analysis date:
2025-11-18 06:44:11 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
94.9%
Tags:
shellcode shell sage
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
Creating a file in the Program Files subdirectories
Launching cmd.exe command interpreter
Creating a service
Launching a service
Сreating synchronization primitives
Creating a file
Moving a recently created file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Forced system process termination
Enabling autorun for a service
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
adaptive-context crypt fingerprint installer installer keylogger microsoft_visual_cc overlay overlay
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-17T06:22:00Z UTC
Last seen:
2025-11-17T06:41:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Ransom.Win32.Generic HEUR:Trojan.PowerShell.Generic HEUR:HackTool.Win64.NoDefender.a HEUR:HackTool.PowerShell.InvokeObfuscation.gen Trojan.PowerShell.Kriptik.sba BSS:HackTool.Win32.Yzon.a Trojan.PowerShell.Cobalt.sb
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Signature
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to register a low level keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Suspicious powershell command line found
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Score:
71%
Verdict:
Malware
File Type:
PE
Verdict:
Malware
YARA:
5 match(es)
Tags:
DeObfuscated Executable PE (Portable Executable) PE File Layout PowerShell SFX 7z Win 32 Exe x86
Verdict:
Malicious
Threat:
Trojan.PowerShell.Kriptik
Threat name:
Win32.Ransomware.Pay2Key
Status:
Suspicious
First seen:
2025-11-18 04:28:57 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
23 of 38 (60.53%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
hacktool_defendernot
Similar samples:
+ 1'101 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery execution upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
UPX packed file
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Executes dropped EXE
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
e1a3e3e0cc2e8b9476504c920ee20c9e50ef9f3270d7c4562da774dd9c990c58
MD5 hash:
a06636d2b8aa4ce2a05d484a510f35cd
SHA1 hash:
0118ba6026af1769a6a46925b81a07ea41a834b3
SH256 hash:
1273e8c2d25318149cbcdf4cff8c6a1e00d8aa37664f482149cb132b119d2547
MD5 hash:
e495bf2c1e6dae2ea4a52b70e280b190
SHA1 hash:
13638a3689e2e554d1ce4b3f6fadb427cfa449e0
SH256 hash:
b6301160d2cceb9df1bb2d0548d65c31ecc38b694fa5efe67899935f19870fce
MD5 hash:
46857dedd8ea45006ec3ebff24739f8b
SHA1 hash:
47bd7d9f2eb13d178327769b964043887258390e
SH256 hash:
f457b1cb1b146ab07117e34dc50881ef787946a0311467d82469fdaa3e54884c
MD5 hash:
52b7073101ce2f83c85ed698f1ee0445
SHA1 hash:
cd2f016c79de7d4bf20d1366cc9483b610b4ffc2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.