MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e596237b4036cf7a055edb402aff1f5a07852d6e2276836996654a6056820ebf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 31 File information Comments

SHA256 hash:	e596237b4036cf7a055edb402aff1f5a07852d6e2276836996654a6056820ebf
SHA3-384 hash:	e1d1a4376855acd67ce40ba5c6b4a00afe7ea268bf22994a4486bb0eb97d37336e0cd75412db144a47106d85a98e15ab
SHA1 hash:	6ada644a8f4a3756f03c507d9cff7e202072c80e
MD5 hash:	f60091cadcde21706b8999106ffbc4fd
humanhash:	uranus-friend-magazine-romeo
File name:	e596237b4036cf7a055edb402aff1f5a07852d6e2276836996654a6056820ebf.bin
Download:	download sample
File size:	13'920'276 bytes
First seen:	2026-09-27 14:10:32 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:GBZ3WVKrG7wJNghOjM6Y+jXwzCEcH6G7WJ3eF:GBNbrG7wHdYxzCEcHRDF
TLSH	T1C1E633C6FF7E890405960784D73A4D3183E86E50BAE71896B8141708E6447FAFFA8ED7
Magika	zip
Reporter	whack_sh
Tags:	zip

Intelligence

File Origin

# of uploads :

# of downloads :

123

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	unknown迷你世界工具1.7.4无壳版.exe
File size:	27'084'288 bytes
SHA256 hash:	7fe5234e9c99976341e512b52556fda45509bead4dc4ab272c07c7a624c1d900
MD5 hash:	784a1b552d1f126ab299150ae78ca5b6
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/932ef45e-f532-441d-a79e-f5be0e555a91/

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/e596237b4036cf7a055edb402aff1f5a07852d6e2276836996654a6056820ebf/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm crypto evasive expand fingerprint keylogger lolbin mingw overlay packed packed reconnaissance wmic

Link:

https://www.filescan.io/uploads/6ab924091a9529d9316b24cf/reports/3e7c2e04-c983-42c7-8bbc-148aa9f8f893/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e596237b4036cf7a055edb402aff1f5a07852d6e2276836996654a6056820ebf

Score:

94%

Verdict:

Malware

File Type:

Malware Config

C2 Extraction:

CNC: L

Link:

https://app.malva.re/file/f60091cadcde21706b8999106ffbc4fd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e596237b4036cf7a055edb402aff1f5a07852d6e2276836996654a6056820ebf/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4wlcg62ag3hxubk63nacv7y7lidyklloej3ig2mwmvfgavucb27q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

defense_evasion discovery spyware trojan

Link:

https://tria.ge/reports/260927-vmgkcasfkb/

Behaviour

Modifies system certificate store

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	Check_Debugger Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_SliverFox_String Create hunting rule
Author:	huoji
Description:	Detect files is `SliverFox` malware

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	SUSP_Websites Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference of suspicious sites that might be used to download further malware

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants

Rule name:	without_attachments Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any attachment
Reference:	http://laboratorio.blogs.hispasec.com/

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip e596237b4036cf7a055edb402aff1f5a07852d6e2276836996654a6056820ebf

(this sample)

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample