MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 24 File information Comments

SHA256 hash:	e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b
SHA3-384 hash:	96c39c2bc4b24a5def3b9706468aa537a334279c5ce83631400bd2439627115d328bfa3b61a3fabc65990fdc45df47d8
SHA1 hash:	e1cc4cef1f7d7794edce15d84db5ab8bc6461380
MD5 hash:	a9018fd08c2d1b6b6cccbe5a7d1a2c8d
humanhash:	quiet-friend-cat-salami
File name:	file
Download:	download sample
File size:	3'850'240 bytes
First seen:	2026-03-07 00:04:43 UTC
Last seen:	2026-03-07 01:02:38 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c05eafbf2c8c8448f56fb1998451e045
ssdeep	49152:1oJesTo/llvt+4hzsifepH7ZBkwdO/yXgoGIAb9VFd5gI1hJYOfCo:HlVoWztmpH7ZBkwdoyTGIIb5LnJYOfC
TLSH	T1BC068C93A693E9E9C31BCCF9C551673EA7D3BC29231DB2530A69F34DAA33D246604704
TrID	52.5% (.EXE) UPX compressed Win64 Executable (70117/5/12) 20.2% (.EXE) UPX compressed Win32 Executable (27066/9/6) 12.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 4.8% (.EXE) Win64 Executable (generic) (6522/11/2) 3.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543

Bitsight

url: http://158.94.211.222/files/6902778688/uxQfUNw.exe

Intelligence

File Origin

# of uploads :

# of downloads :

195

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

_e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b.exe

Verdict:

Malicious activity

Analysis date:

2026-03-07 00:06:26 UTC

Tags:

auto-sch auto-reg upx crypto-regex amsi-bypass

Link:

https://app.any.run/tasks/dcfe0f89-f900-4942-b10a-a9bf94898f22

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/56467/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ab6bcafa45d5f85206ae76

Tags:

vmdetect autorun emotet

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm anti-vm base64 crypto crypto evasive fingerprint lolbin obfuscated oreans_codevirtualizer overlay packed packed packed rundll32 schtasks

Link:

https://www.filescan.io/uploads/69ab6bbe10e80629d40093ac/reports/ed905e50-b580-4f59-826f-8e97684b9966/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b

Result

Gathering data

Verdict:

Malicious

File Type:

exe x64

Detections:

Trojan-Spy.Win32.Xegumumune.sba Trojan-PSW.Win32.Stealer.sb Backdoor.Win32.Androm.sb Trojan-PSW.Win32.Pycoon.sb Trojan-Dropper.Win32.Injector.sb Trojan-Dropper.Win32.Agent.sb Trojan.Win32.Inject.sb Trojan.Win32.Agent.sb HEUR:Trojan.Win32.Agentb.gen HEUR:HackTool.Multi.AmsiETWPatch.gen

Link:

https://opentip.kaspersky.com/e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4cfa315a-1ef8-4bde-b733-b37655531e21

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/a9018fd08c2d1b6b6cccbe5a7d1a2c8d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b/

Verdict:

Malicious

Threat:

Trojan-PSW.Win32.Inject

Link:

https://tip.neiki.dev/file/e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5efyzph3uvwfp6iqwcjx7qt4lolrtraj5irf35lvjgixii26gavq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery execution persistence spyware stealer upx

Link:

https://tria.ge/reports/260307-adbbrahx9z/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

UPX packed file

Adds Run key to start application

Executes dropped EXE

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b

MD5 hash:

a9018fd08c2d1b6b6cccbe5a7d1a2c8d

SHA1 hash:

e1cc4cef1f7d7794edce15d84db5ab8bc6461380

Link:

https://www.unpac.me/results/a2c170fd-3161-44db-aad1-be97a23a7e18/

SH256 hash:

b391edb67c48da50a10dd4e28e63ef1e912833c1aedd2557d21cb12c13088c96

MD5 hash:

39d38b887a21049eb5757279e8bc2a66

SHA1 hash:

f5fe1958909c7005b26efdcc4d8e500e9ebd1658

Link:

https://www.unpac.me/results/a2c170fd-3161-44db-aad1-be97a23a7e18/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e90b8cbcfba5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	Check_VBox_Description Create hunting rule

Rule name:	Check_VmTools Create hunting rule

Rule name:	CMD_Ping_Localhost Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	HKTL_Meterpreter_inMemory Create hunting rule
Author:	netbiosX, Florian Roth
Description:	Detects Meterpreter in-memory
Reference:	https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_ReflectiveLoader Create hunting rule
Author:	ditekSHen
Description:	Detects Reflective DLL injection artifacts

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe e90b8cbcfba56c57f910b0937fc27c5b9719c409ea225df575499174235e302b

(this sample)

Dropped by

Amadey

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3791151/

Cape

https://www.capesandbox.com/analysis/56467/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample