MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1bae7b12943d03f1077f98b3ace2886cfb7632ed15623f99c2c763b60a1ba98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

N-W0rm

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 3 File information Comments

SHA256 hash:	e1bae7b12943d03f1077f98b3ace2886cfb7632ed15623f99c2c763b60a1ba98
SHA3-384 hash:	948d7fa027d632a9e311338fd6790d9222ff8f40d2ce4802563d99c008b4f2b9c5c47ccfa962a629f78475421b801d10
SHA1 hash:	d67f164e763e6773162a2916047bcafdb0ffe100
MD5 hash:	bc2384b22b960ceac16fddf2bd3f39a9
humanhash:	mexico-freddie-item-california
File name:	SecuriteInfo.com.Win64.MalwareX-gen.12738368
Download:	download sample
Signature	N-W0rm Create hunting rule
File size:	444'416 bytes
First seen:	2025-12-20 04:20:04 UTC
Last seen:	2025-12-20 05:19:52 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	6144:FQqHvnhoOXgo8cwCdIrgF4TcJ32/3t3WpZ38geyshhGqh1jc05nSBFB:pHvhjv8bCdZFvm/9mp58Dysh8qXc2n
TLSH	T1B194234045FDD8E6E59B8636DDD77CA85920C283684AEB7F70098B4D1F43BF84A12D2E
TrID	56.5% (.EXE) Win64 Executable (generic) (10522/11/4) 11.0% (.ICL) Windows Icons Library (generic) (2059/9) 10.9% (.EXE) OS/2 Executable (generic) (2029/13) 10.7% (.EXE) Generic Win/DOS Executable (2002/3) 10.7% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe N-W0rm

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
212.11.64.102:58002	https://threatfox.abuse.ch/ioc/1683724/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Win64.MalwareX-gen.12738368

Verdict:

Malicious activity

Analysis date:

2025-12-20 04:22:30 UTC

Tags:

auto-sch-xml purecrypter

Link:

https://app.any.run/tasks/7942e0be-161f-45a2-b7c4-9035fb060789

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/45559/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.12738368.UNOFFICIAL

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=694623fdee899ae4567f142e

Tags:

virus sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

barys base64 net_reactor obfuscated packed packed unsafe

Link:

https://www.filescan.io/uploads/69462404e126b9ff4389aa71/reports/6046590e-1e67-4c8b-b656-5c4badcd2eec/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/e1bae7b12943d03f1077f98b3ace2886cfb7632ed15623f99c2c763b60a1ba98

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-12-20T00:32:00Z UTC

Last seen:

2025-12-21T20:00:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e1bae7b12943d03f1077f98b3ace2886cfb7632ed15623f99c2c763b60a1ba98/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/75111c10-b7fd-4216-a904-d7db64cec963

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e1bae7b12943d03f1077f98b3ace2886cfb7632ed15623f99c2c763b60a1ba98

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.98 Win 64 Exe x64

Link:

https://app.malva.re/file/bc2384b22b960ceac16fddf2bd3f39a9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e1bae7b12943d03f1077f98b3ace2886cfb7632ed15623f99c2c763b60a1ba98/

Threat name:

Win64.Trojan.Sonbokli

Status:

Malicious

First seen:

2025-12-20 04:20:22 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4g5opmjjipid6edx7gftvtriq3h3oyzo2flch6m4fr3dwyfbxkma._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/251223-nvd1vswkew/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/21f38bf8-8064-4e76-9672-56be9f1e738f

Unpacked files

SH256 hash:

e1bae7b12943d03f1077f98b3ace2886cfb7632ed15623f99c2c763b60a1ba98

MD5 hash:

bc2384b22b960ceac16fddf2bd3f39a9

SHA1 hash:

d67f164e763e6773162a2916047bcafdb0ffe100

Link:

https://www.unpac.me/results/56b0e5b6-63b1-4673-a4fb-92729b3dfa58/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e1bae7b12943/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e1bae7b12943d03f1077f98b3ace2886cfb7632ed15623f99c2c763b60a1ba98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)