🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e52d35b6be2ed20b97c41e9ab067914368e0106dab128ce119d65f20fd1e64eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e52d35b6be2ed20b97c41e9ab067914368e0106dab128ce119d65f20fd1e64eb
SHA3-384 hash: b069b2e88e32f40cf77729227b5c10473bfe039a9a55d7b4e8ff5bc29bd7f7231832b066ecbc4a486acd2000d8a0c36c
SHA1 hash: bb60054daa15de2f2c3decb14ace5a6a772af61f
MD5 hash: c7fe3212411042ff726ab2c967b670e6
humanhash: alanine-spring-carolina-tennis
File name:SOA20261007054.291E17.vhdx
Download: download sample
File size:37'748'736 bytes
First seen:2026-10-07 20:33:10 UTC
Last seen:Never
File type:
MIME type:application/octet-stream
ssdeep 98304:7WCPEp3NBOMoNxY9J4SwEi8qmlNvZxOs3gz5da2aUydgHGyB8qyzojcAnG:R5QCv8qmlNvPtgzzcGL2g
TLSH T18487CF213981C03ED2AA13708D7DB7B963BDAD201F3581DF62C87A2D6F709D25936663
Magika iso
Reporter smica83
Tags:vhdx

Intelligence

File Origin
# of uploads :
1
# of downloads :
10
Origin country :
HU HU
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:wmdmps.dll
File size:37'888 bytes
SHA256 hash: f45e4de2803109c86414f1aadef12ca62cdd9601f5b26c261a92dce41efacc0e
MD5 hash: ce3b891bafe4b676297d12a252bc8c07
MIME type:application/x-dosexec
File name:e2a656ef-815d-451e-b5e5-507cef484a8a.dmp
File size:30'312 bytes
SHA256 hash: 68740ce61c18a90f23198b6007c13295457a56f523dafd898f24c6d0a35a727a
MD5 hash: f9933d24898bf78d3a15829f28bbce93
MIME type:application/octet-stream
File name:SOA20261007054.exe
File size:1'994'600 bytes
SHA256 hash: c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
MD5 hash: 711cd47d4524145f9c488afecc85ebc7
MIME type:application/x-dosexec
File name:rime.DLL
File size:3'520'512 bytes
SHA256 hash: 757e393a6c0fdc8ba332a6652d464a34045c121bc9f85f00594422fddab6a83a
MD5 hash: 436933811fb83dbeebada9921cb4e11a
MIME type:application/x-dosexec
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad054476f551121ba15b0a9
Tags:
n/a
Gathering data
Verdict:
Malicious
File Type:
discimage.vhdx
First seen:
2026-10-07T19:15:00Z UTC
Last seen:
2026-10-07T19:36:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e52d35b6be2ed20b97c41e9ab067914368e0106dab128ce119d65f20fd1e64eb/results?tab=lookup
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-07 22:08:59 UTC
File Type:
Binary (Archive)
Extracted files:
78
AV detection:
2 of 24 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4uwtlnv6f3jaxf6ed2nlaz4rinuoaednvmjizyiz2zpsb7i6mtvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/e52d35b6be2ed20b97c41e9ab067914368e0106dab128ce119d65f20fd1e64eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:GenericGh0st
Create hunting rule
Author:Still
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments