MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847
SHA3-384 hash: ff6bad40f103f084fa22a6f4272df1ca1bfd35fb78ea6cb7c4f0cac2b0fa2864d2a945f7d3649c7c6ee02bc4988e5841
SHA1 hash: 0636a09e75a3741951be7ff6c8cfb6a1763b0d39
MD5 hash: 68cbf61ceec7cdae9e2f6db58d636803
humanhash: hot-diet-rugby-snake
File name:file
Download: download sample
File size:5'028'672 bytes
First seen:2026-07-30 19:33:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3f7b5aa911c1855fe355ea7a73cbd1f9
ssdeep 98304:XJ+NtAq3vBHtHwI34j2fUqpoUmM9YF1lzHNZw3+Vy8u7+:XJStAq7OdqpohM9YFNZwONf
TLSH T18D3633067B10E848D65A5938EE71C7F96714FE0EEE8A939734C6BE8BBCD46C14D990C0
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 54b269dcccd8f000
Reporter Bitsight
Tags:D dropped-by-gcleaner EU0.file exe signed

Code Signing Certificate

Organisation:Capture for Network Host
Issuer:Capture for Network Host
Algorithm:sha512WithRSAEncryption
Valid from:2026-07-30T19:12:19Z
Valid to:2031-07-30T19:22:20Z
Serial number: 28c7e585e48d9d994b4e3a9cbdfbea83
Thumbprint Algorithm:SHA256
Thumbprint: 78e1649b740785cc97732a572625c61d0819003ffeb7c29773eb345d80c9ade0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
Bitsight
url: http://91.92.242.236/service

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76876/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a service
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed packed signed themidawinlicense
Link:
https://www.filescan.io/uploads/6a6ba7082a82c920605b80f4/reports/9a3c3774-80a7-4bce-94e3-a6c7347cf8f6/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-30T17:19:00Z UTC
Last seen:
2026-07-30T19:23:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/58e8fb23-b253-4612-88f5-469a1880943f
Score:
22%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/68cbf61ceec7cdae9e2f6db58d636803
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847/
Threat name:
Win64.Malware.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-30 19:34:49 UTC
File Type:
PE+ (Exe)
Extracted files:
7
AV detection:
7 of 24 (29.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6uqthwaxj34man7hh3om576k7ix6fwzhwmuaieykrwpsyfjvtbdq._file
Verdict:
suspicious
Label(s):
RevStealer
Create hunting rule
Link:
https://reports.threatray.com/9d8219ad-0382-4952-a0c5-40efc659bd6c
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion themida trojan
Link:
https://tria.ge/reports/260730-x9rd6swdmh/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Checks whether UAC is enabled
Checks BIOS information in registry
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847
MD5 hash:
68cbf61ceec7cdae9e2f6db58d636803
SHA1 hash:
0636a09e75a3741951be7ff6c8cfb6a1763b0d39
Link:
https://www.unpac.me/results/710f6a26-c96b-41a0-9f94-454152ed261c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.31
Link:
https://yomi.yoroi.company/submissions/f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f52133d8174ef8c037e73edcceffcafa2fe2db27b32804130a8d9f2c15359847

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/76876/

Comments