MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba
SHA3-384 hash:	90c32ecc5d8c8e90819349ce9349359634b8a7cf0991414580b1dcd992d692fa588258817bf31ce0d4204ba2a366c17c
SHA1 hash:	12d275a17741eb625133ac5a57eed297471e286b
MD5 hash:	6777a6dbd29e24616d60004627734c9f
humanhash:	bluebird-idaho-hot-india
File name:	ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba
Download:	download sample
File size:	92'281'344 bytes
First seen:	2026-07-24 16:07:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9b763104e1c7e7b7334a1e9ed4235cd3 (1 x Stealc, 1 x RemusStealer)
ssdeep	393216:d8nVxhanA6rh7CLBAwOdC1yJ8w65aPahY7ZZiRT4VpaUgPj1BiGUtlVpFzeBNsia:d8nvEA6rpCLBwb658a8ZZiOpgPVlcmK
TLSH	T113187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	booking exe njzlopghznkamkl-cfd

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

162

Origin country :

IT

Vendor Threat Intelligence

ACCE MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/323b2e48-1937-4b32-944c-2c95e62d38de/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Creating a process from a recently created file

Launching a process

Creating a process with a hidden window

Launching a service

DNS request

Connection attempt

Sending a custom TCP request

Changing a file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm crypto crypto dropper fingerprint golang overlay reconnaissance

Link:

https://www.filescan.io/uploads/6a638ddd2a241a2f002b3ea0/reports/84207186-df14-4c02-998f-6136713e5696/overview

Hybrid Analysis WinGo_TrojanDropper_Agent_NB_trojan

Verdict:

Malicious

Labled as:

WinGo_TrojanDropper_Agent_NB_trojan

Link:

https://www.hybrid-analysis.com/sample/ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-10T11:58:00Z UTC

Last seen:

2026-07-24T15:37:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5rf5yovivpejg7lthwyt7smcs526chjodcpsuvcgqjiqa2aaes5a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260724-tk2xtsgn5w/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Adds Run key to start application

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.