MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2d2937fd6d4d4f77051673cc6059240ea57c0b19d02ae49adf02ca622af67db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f2d2937fd6d4d4f77051673cc6059240ea57c0b19d02ae49adf02ca622af67db
SHA3-384 hash:	318addee273f7871341433b72153f1c442fa051d25175cf5ea5feba1e419596d3961177bc7fa4ae99dc4be716f9d0879
SHA1 hash:	a2cee7e37d6e5fa3f5fb62607771df989eaae367
MD5 hash:	75763eb8c6da42333797605c9f669982
humanhash:	victor-johnny-purple-undress
File name:	U2MP3.exe
Download:	download sample
File size:	87'507'038 bytes
First seen:	2025-12-31 08:09:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	dcaf48c1f10b0efa0a4472200f3850ed (716 x Efimer, 60 x BlankGrabber, 23 x SalatStealer)
ssdeep	1572864:yEWa9Il1txjfJCz+2e7/uY0YlFAkSu/ISTey6NSS6jj5bpSS1MI33XiIyZzfNtPp:yEWaWXtxlCzQ/EaF1Riy6NMjjRpSo13q
TLSH	T1681833E947D2892BF9F10C7A82B6D3BBD415FD0E8F5A4009BF9E71911FBB2850471A09
TrID	66.6% (.EXE) InstallShield setup (43053/19/16) 16.2% (.EXE) Win64 Executable (generic) (10522/11/4) 7.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.1% (.EXE) OS/2 Executable (generic) (2029/13) 3.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	9e23332b2933338e
Reporter	5kidRoot
Tags:	exe SpyEyes spyware trojan

5kidRoot

The following sample was obtained from the following website: https://v2mp3[.]com

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

366

Origin country :

ES

Vendor Threat Intelligence

ACCE PyInstaller

Details

Link:

https://research.acce.ciphertechsolutions.com/results/455829cd-defc-474f-bec2-914fa17ed6b6/

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

U2MP3.exe

Verdict:

Suspicious activity

Analysis date:

2025-12-31 08:12:14 UTC

Tags:

pyinstaller python

Link:

https://app.any.run/tasks/99354a2e-97a4-4052-953b-b49bd375b3d1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6954da42d2357cccc3de1ad6

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

expand installer-heuristic lolbin microsoft_visual_cc overlay overlay packed pyinstaller unsafe

Link:

https://www.filescan.io/uploads/6954da388d1aa9829e27dbba/reports/3bdd886a-01d9-4672-bed4-20401b903eda/overview

Hybrid Analysis QD:Trojan.GenericQ

Verdict:

Malicious

Labled as:

QD:Trojan.GenericQ

Link:

https://www.hybrid-analysis.com/sample/f2d2937fd6d4d4f77051673cc6059240ea57c0b19d02ae49adf02ca622af67db

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-10-23T19:05:00Z UTC

Last seen:

2026-01-01T18:32:00Z UTC

Hits:

~100

Detections:

Trojan-Spy.Win32.SpyEyes Trojan-PSW.Win32.Stealer.sb BSS:Trojan.Win32.Generic Trojan-Spy.Win32.SpyEyes.btsa

Link:

https://opentip.kaspersky.com/f2d2937fd6d4d4f77051673cc6059240ea57c0b19d02ae49adf02ca622af67db/results?tab=lookup

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/f2d2937fd6d4d4f77051673cc6059240ea57c0b19d02ae49adf02ca622af67db

CERT.PL MWDB

Gathering data

Neiki Trojan-Spy.Win32.SpyEyes

Verdict:

Malicious

Threat:

Trojan-Spy.Win32.SpyEyes

Link:

https://tip.neiki.dev/file/f2d2937fd6d4d4f77051673cc6059240ea57c0b19d02ae49adf02ca622af67db

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-10-24 04:56:32 UTC

File Type:

PE+ (Exe)

Extracted files:

4299

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ljjg76w2tkpo4crm46mmbmsidvfpqfrtubk4snn6awkmivpm7nq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery pyinstaller

Link:

https://tria.ge/reports/260106-n4apssg13b/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Loads dropped DLL

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5fa66983-5ae9-42bd-ad11-e903901b6b4f

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f2d2937fd6d4d4f77051673cc6059240ea57c0b19d02ae49adf02ca622af67db