🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 29 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122
SHA3-384 hash: 9fa451af58d7c0df548d3c9bc2ef312c67c8ea7e94310f89db96595e3427a1df62c9b9afd76c9e07da30a462c32bd47a
SHA1 hash: 0df920c5f2fa3ba4c2679efbe65744241c96396b
MD5 hash: e1f049810fd4384b14146df716239c3f
humanhash: golf-fruit-magnesium-coffee
File name:e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122.exe
Download: download sample
File size:5'798'912 bytes
First seen:2026-10-21 17:23:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'297 x AgentTesla, 20'716 x Formbook, 12'402 x SnakeKeylogger)
ssdeep 49152:2ryxWmXZLsaBxzeBmh3vRzTh9nvP9yRay8rh9nvP9yRd4efhCSA/Bkj0Q+BEzDa:7xDleBmh35z/39UU3964SAzcDa
TLSH T16246BE09B3E81F6AD1BF8B79A074123193B0ED03E322CB8F5585E9AD1C637854D52B67
TrID 58.3% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
17.1% (.WLX) Total Commander Lister extension (plugin) (21500/1/6)
5.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
dhash icon 70fcf2eaf898c070 (1 x AsyncRAT)
Reporter Tuxxin
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-21 17:59:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9bc65e14-9fa4-4aaa-9973-135289bb43ac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/93679/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Korplug.1524.815.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad8f5425a22ac805bd91c13
Tags:
keylog micro virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Moving a recently created file
Unauthorized injection to a recently created process
Restart of the analyzed sample
Searching for the window
Creating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 cmd corrupted evasive explorer javac lolbin obfuscated obfuscated overlay packed reconnaissance vbnet
Link:
https://www.filescan.io/uploads/6ad8f53eff1ca211e982ac11/reports/dbd7cece-f48c-4e6f-ac9c-8cbe8b86f60d/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122
Verdict:
Unknown
File Type:
exe x32
Link:
https://opentip.kaspersky.com/e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8d17bd4b-e24c-425c-8345-8d92e735a9f2
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1990214
Signature
Antivirus detection for URL or domain
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1990214 Sample: zo3a3adqkP.exe Startdate: 21/10/2026 Architecture: WINDOWS Score: 48 10 Antivirus detection for URL or domain 2->10 6 zo3a3adqkP.exe 4 2->6         started        process3 process4 8 zo3a3adqkP.exe 11 16 6->8         started       
Score:
79%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122
Verdict:
inconclusive
YARA:
9 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.21 SOS: 0.22 SOS: 0.23 SOS: 0.26 SOS: 0.28 SOS: 0.29 SOS: 0.32 SOS: 0.44 Win 32 Exe x86
Link:
https://app.malva.re/file/e1f049810fd4384b14146df716239c3f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-21 17:24:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
262
AV detection:
8 of 38 (21.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4pxrwhbzxrki7gufkeu5vnitjicytqjqllo2tuy4xjuxyj7aoera._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261021-vys3hset81/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122
MD5 hash:
e1f049810fd4384b14146df716239c3f
SHA1 hash:
0df920c5f2fa3ba4c2679efbe65744241c96396b
Detections:
cn_utf8_windows_terminal
Create hunting rule
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
SH256 hash:
0744f961654253d4d836f48612bdf07dbac951527ae7f037eeeb70fc63eab425
MD5 hash:
290a50a0894761c027a175b5ea3d3b95
SHA1 hash:
c44139d5e7d392cb89320168799bec74edf029f3
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
SH256 hash:
d7debf2b9fa9bce29af49f8b16b87bee9a85c7c414dfc2f94f0beba6bdb3fcfa
MD5 hash:
564a99ae04dbbcea00ff4baca500fcee
SHA1 hash:
9ee9131317b54136abff0f7e1c735ff86eb81076
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
SH256 hash:
f0fc15fd4b71556d211388577a69e9f4d06000ca6c9e508078c263935c6df4dc
MD5 hash:
ad247ec0dd79938a7a4a28e6a7ec6bb1
SHA1 hash:
d8918fcc429abeb565841201d655b90a169716a4
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
SH256 hash:
4bb54a73ba8957fd71772da3d499944bde1337b08668ec5ed5909ea2b2e45ad1
MD5 hash:
30514f8c01478ba772d3ef69518e0c73
SHA1 hash:
0b861652c6331551ac65c9c392daaedfe29d2d57
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
SH256 hash:
332d9caf9c0172aabd7ff8ca909967d31dc17329b64b65d1fb13b84c6ca5a729
MD5 hash:
8298c971e8a367499cd9fbeee08d0472
SHA1 hash:
a3b8e87d2975b8b7cb5656a16d3794e85aeb8166
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
SH256 hash:
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 hash:
195ffb7167db3219b217c4fd439eedd6
SHA1 hash:
1e76e6099570ede620b76ed47cf8d03a936d49f8
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
SH256 hash:
7426fa087df6966570bb4eaac2d42522803063453c29517874eda820cac4ce75
MD5 hash:
8cdeb39e03fe25872ac7569003a3e3ad
SHA1 hash:
cd083b7b203375f24b474f8573863134e5c2f3d3
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
SH256 hash:
00664130b963ace5f1243ae4786926ea81bc181086fc7149d6123567c304d35b
MD5 hash:
4a7816cb1067972450045e4afa50a0b8
SHA1 hash:
b92c69941c66d5526ff151e523eb92a8a90fc06a
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
SH256 hash:
dc14a3500d5a7763191d1ced09efbeeb7dbe79a762811ea2cdb1d2f47f1032a6
MD5 hash:
ca489d8a94e2235933e74bd10d9def01
SHA1 hash:
a2dc3205cfe978bb06448225b2f9f894e062e0f9
Link:
https://www.unpac.me/results/5db313ab-90b0-4997-b400-8cb60eb2fc77/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cerberus
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Cerberus
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MAL_Trigon_Dropper
Create hunting rule
Author:jaszzz
Description:Trigon multi-stage malicious dropper - process injection, keylogging, screenshot capture
Reference:URL|trigon
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings
Rule name:win_dotnet_vb_stealer_rat
Create hunting rule
Author:Arrbat
Description:Detects .NET/VB executables with stealer/RAT capabilities (sockets, HTTP, processes, registry, etc).
Rule name:WIN_Malware_Ceber_ForgeAuto_8b9c7147_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Ceber (pe, etat extrait)
Rule name:WIN_Malware_Cerber_ForgeAuto_b3e1e9d9
Create hunting rule
Author:Marjoriefort
Description:Detects Cerber (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_180e12ce_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_bbda4050_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:Win_Ransomware_LockBit5_Consolidated
Create hunting rule
Author:RussianPanda, S2W, ransomware.live (Consolidated)
Description:Consolidated rule to detect LockBit 5.0 (Erebus) Ransomware payloads and notes

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe e3ef1b1c39bc548f9a855129dab5134a0589c1305adda9d31cba697c27e07122

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/93679/

Comments