MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4d64982d9848a9c10560b310e2e2d9f11b4e9f0b56630158fd7828a879b8734. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 14

Intelligence 14 IOCs YARA 3 File information Comments

SHA256 hash:	e4d64982d9848a9c10560b310e2e2d9f11b4e9f0b56630158fd7828a879b8734
SHA3-384 hash:	d47a3d57d88a501588c042d1857123e72e14f89b4c00f3945a62efcbdbe5a9744bda3d9ca56e780f77e3f2267cfc2952
SHA1 hash:	ee4e30d1df6b1b523075cf90bf863604eef9362e
MD5 hash:	95f0930cd82ce2bcfb8aa76417ddb127
humanhash:	potato-video-florida-zulu
File name:	SecuriteInfo.com.Win64.MalwareX-gen.82153197
Download:	download sample
File size:	29'696 bytes
First seen:	2025-11-28 20:43:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4b2df774f65211b4962a056c4da67248
ssdeep	768:jSyJIBSNxAq1/VPRMzZhSM9og1gsNhuXpsCWo:jhI5o2zsa7u5Uo
TLSH	T13BD2D00751902B38FAFC09369F3A9955207EBC364FB5C3986B96544E68D0443BDBCBE1
TrID	63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12) 24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.8% (.ICL) Windows Icons Library (generic) (2059/9) 1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	29'696 bytes
File size (de-compressed) :	61'952 bytes
Format:	win64/pe
Unpacked file:	9d85b51b1fe63c33866c3664f15a35f6199eb7b3f9bdb1cee3fe499cc4c4ae33

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

Setup.exe

Verdict:

Malicious activity

Analysis date:

2025-11-28 19:38:32 UTC

Tags:

loader auto sliver framework stealer purecrypter purelogs payload silverfox backdoor valley winos rat metastealer redline exfiltration purehvnc meduza netreactor github ta558 apt stegocampaign reverseloader valleyrat evasion phishing nanocore upx

Link:

https://app.any.run/tasks/6e2b3a50-83b0-4e79-9355-50fa6dd70af3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/41742/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.82153197.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=692a09a36657e3433281f29f

Tags:

autorun agent virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending a custom TCP request

DNS request

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug crypto packed packed packed upx

Link:

https://www.filescan.io/uploads/692a09a3ab9dcca0c6fbb4d6/reports/7b74999b-2971-48da-9c35-d31df3c05341/overview

Verdict:

Malicious

Labled as:

Trojan[Ransom]/MSIL.HiddenTear

Link:

https://www.hybrid-analysis.com/sample/e4d64982d9848a9c10560b310e2e2d9f11b4e9f0b56630158fd7828a879b8734

Result

Gathering data

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-11-28T16:53:00Z UTC

Last seen:

2025-11-28T17:24:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e4d64982d9848a9c10560b310e2e2d9f11b4e9f0b56630158fd7828a879b8734/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/ac426dac-aa2f-4a88-9ac7-eb749663d1a3

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e4d64982d9848a9c10560b310e2e2d9f11b4e9f0b56630158fd7828a879b8734

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/95f0930cd82ce2bcfb8aa76417ddb127

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e4d64982d9848a9c10560b310e2e2d9f11b4e9f0b56630158fd7828a879b8734/

Verdict:

Malicious

Threat:

RemoteAdmin.LiteManager.TCP

Link:

https://tip.neiki.dev/file/e4d64982d9848a9c10560b310e2e2d9f11b4e9f0b56630158fd7828a879b8734

Threat name:

Win64.Trojan.Barys

Status:

Malicious

First seen:

2025-11-28 20:44:18 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

22 of 36 (61.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4tletawzqsfjyecwbmyq4lrnt4i3j2pqwvtdafmp26bivb43q42a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

upx

Link:

https://tria.ge/reports/251128-zh94bawrez/

Behaviour

UPX packed file

Drops startup file

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/4809447d-f1f8-41d5-990f-96e7f7f0eced

Unpacked files

SH256 hash:

e4d64982d9848a9c10560b310e2e2d9f11b4e9f0b56630158fd7828a879b8734

MD5 hash:

95f0930cd82ce2bcfb8aa76417ddb127

SHA1 hash:

ee4e30d1df6b1b523075cf90bf863604eef9362e

Link:

https://www.unpac.me/results/f783616d-d670-4d17-af6c-d8ba04e6d794/

SH256 hash:

9d85b51b1fe63c33866c3664f15a35f6199eb7b3f9bdb1cee3fe499cc4c4ae33

MD5 hash:

8a7217fe067764297ff02945a05e9e94

SHA1 hash:

1318b1ce78a11ee57d127549e698d9236e464b35

Link:

https://www.unpac.me/results/f783616d-d670-4d17-af6c-d8ba04e6d794/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.56

Link:

https://yomi.yoroi.company/submissions/e4d64982d9848a9c10560b310e2e2d9f11b4e9f0b56630158fd7828a879b8734

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.