MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecf56354f1699c343bade1e4dfab9eec25b370b53cde1f2eb1d8837ab25cac44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	ecf56354f1699c343bade1e4dfab9eec25b370b53cde1f2eb1d8837ab25cac44
SHA3-384 hash:	cb662fb45e952095e16737c85f70c5956f0c1b553d1c270db94fdc4a0be0cf90f6007e416db9655ccb523a4f7c449c8b
SHA1 hash:	bf370df72f60181ae4741a83f20f733d9435d82b
MD5 hash:	17aba3258755bc420c54f8a079208c42
humanhash:	california-muppet-magnesium-music
File name:	SecuriteInfo.com.FileRepMalware.32821747
Download:	download sample
File size:	74'240 bytes
First seen:	2026-02-07 20:07:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	804f215ec136a2d8766a73e605481db0
ssdeep	1536:15l8EoNLDd0E7ccWlWUEvwznKklGgYtRFC:rl8EoLJPWgFwWkl22
TLSH	T108735C1AA34318ECD61BC5B086EF6733BA72F8B756309F2F5754DA351D10E902F1A624
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10522/11/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 aa85cf1907509b2fcc3c7c9d61f71bed10812502a6fefc30ea80203621e467b9

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	37'888 bytes
File size (de-compressed) :	74'240 bytes
Format:	win64/pe
Packed file:	aa85cf1907509b2fcc3c7c9d61f71bed10812502a6fefc30ea80203621e467b9

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.FileRepMalware.32821747

Verdict:

Malicious activity

Analysis date:

2026-02-07 20:11:03 UTC

Tags:

barys auto-startup

Link:

https://app.any.run/tasks/03d0b335-d8bd-445b-bc8d-bbdc9c6bdb3c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/52641/

Detection(s):

Win.Malware.Malwarex-10058597-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69879bb43cadc639ed8462fd

Tags:

backdoor autorun botnet virus

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-debug crypto packed

Link:

https://www.filescan.io/uploads/69879bb2981ff1d38a4c7c47/reports/8c45059d-998f-4ff7-9b22-f1f7041cb9c7/overview

Verdict:

Malicious

Labled as:

Sofacy.Generic

Link:

https://www.hybrid-analysis.com/sample/ecf56354f1699c343bade1e4dfab9eec25b370b53cde1f2eb1d8837ab25cac44

Result

Gathering data

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/dc868580-f22d-492e-8103-98023edd9fcd

Result

Threat name:

DDOS Bot

Detection:

malicious

Classification:

troj.adwa.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1865361

Signature

Contains functionality to detect sleep reduction / modifications

Drops PE files to the startup folder

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected DDOS Bot

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ecf56354f1699c343bade1e4dfab9eec25b370b53cde1f2eb1d8837ab25cac44

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/17aba3258755bc420c54f8a079208c42

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ecf56354f1699c343bade1e4dfab9eec25b370b53cde1f2eb1d8837ab25cac44/

Verdict:

Malicious

Threat:

Trojan.Win32.Scar

Link:

https://tip.neiki.dev/file/ecf56354f1699c343bade1e4dfab9eec25b370b53cde1f2eb1d8837ab25cac44

Threat name:

Win64.Trojan.Sofacy

Status:

Malicious

First seen:

2026-02-07 20:08:18 UTC

File Type:

PE+ (Exe)

AV detection:

16 of 36 (44.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5t2wgvhrngodio5n4hsn7k465qs3g4fvhtpb6lvr3cbxvms4vrca._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/260207-ywmz9sbz3c/

Behaviour

Drops startup file

Unpacked files

SH256 hash:

ecf56354f1699c343bade1e4dfab9eec25b370b53cde1f2eb1d8837ab25cac44

MD5 hash:

17aba3258755bc420c54f8a079208c42

SHA1 hash:

bf370df72f60181ae4741a83f20f733d9435d82b

Link:

https://www.unpac.me/results/c4521e96-9b40-49d3-ad00-115e79214b69/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ecf56354f1699c343bade1e4dfab9eec25b370b53cde1f2eb1d8837ab25cac44

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.