MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4258bdfa82a1065aa1095ae2c6da4240f6ebe20ba285e56f1e216eec5984510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e4258bdfa82a1065aa1095ae2c6da4240f6ebe20ba285e56f1e216eec5984510
SHA3-384 hash:	6b7356505e753e085f2ac57e110289dfef635becd42cb071cc750e5a7c4df7f9ea356035a36df3330ff4627ad7740f1e
SHA1 hash:	df06666f061e4b318c807bcdb7464e510f028237
MD5 hash:	4e6f239440ee9f18b1361c6776966ec9
humanhash:	illinois-equal-ink-twenty
File name:	2-1180-25_24.06.2025.HTA
Download:	download sample
Signature	Gamaredon Alert Create hunting rule
File size:	3'636 bytes
First seen:	2025-06-28 14:39:43 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:tRuqxAqw34BR7nismC/dZmo9MYEUS3L+vXl7l4c9EI6k+hirf/FC7:bfAFSRaC/dZmoyslGOv4
TLSH	T15771862A5F0D08A0030A93DE9676674CFFD004A7EBF6D530F454252EECB2668D75B17A
Magika	vba
Reporter	abuse_ch
Tags:	gamaredon hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

67

Origin country :

SE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.HTA.Gamaredon-D.31257.25154.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685e760c0fceda814b468903

Tags:

n/a

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/e4258bdfa82a1065aa1095ae2c6da4240f6ebe20ba285e56f1e216eec5984510/results/dashboard

Payload URLs

URL

File name

https://nylonjEd.com

HTA File

Behaviour

BlacklistAPI detected

Hybrid Analysis Trojan_Script_Wacatac_B_ml

Verdict:

Malicious

Labled as:

Trojan_Script_Wacatac_B_ml

Link:

https://www.hybrid-analysis.com/sample/e4258bdfa82a1065aa1095ae2c6da4240f6ebe20ba285e56f1e216eec5984510

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1724700

Signature

Multi AV Scanner detection for submitted file

Uses dynamic DNS services

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

41%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/e4258bdfa82a1065aa1095ae2c6da4240f6ebe20ba285e56f1e216eec5984510

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/4e6f239440ee9f18b1361c6776966ec9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e4258bdfa82a1065aa1095ae2c6da4240f6ebe20ba285e56f1e216eec5984510/

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-24 09:41:06 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4qsyxx5ifiiglkqqswxcy3neeqhw5praxiuf4vxr4ilo5rmyiuia._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery

Link:

https://tria.ge/reports/250628-r15mjsem9z/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Blocklisted process makes network request

Malware Config

Dropper Extraction:

http://google.com@document-downloads.ddns.net/OD/sensationaSL/AprilcWs.jpeg

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e4258bdfa82a1065aa1095ae2c6da4240f6ebe20ba285e56f1e216eec5984510