MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b
SHA3-384 hash: 1812952c94a943753afc199090318c52d66afa6a4167f5c6b805011f9d86fb3e07fdae56b35d7c8b774c208b785547f4
SHA1 hash: 892f2a5e99fb8bfd0fd175601b375d9f1554fdfe
MD5 hash: f3da2bfd1feccb09f81cce297d33a3f7
humanhash: sixteen-california-floor-failed
File name:file
Download: download sample
File size:921'752 bytes
First seen:2025-10-30 20:26:59 UTC
Last seen:2025-10-31 10:34:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ef6430f3c102b3577bd72ae77ced7148
ssdeep 12288:l/xda91uZYcWP4uyTphkjfXzANWbk4uOyR2OPGGsBIzyDrY4VaAwte+X4eAn7WGm:bjdo2N6fMNWbuOrOxs2zptE+IeXW8YO
TLSH T169157C125F75E204F176C13CD2F69613EA7AF80C96B2AA638488C70A2392747F74975F
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.6% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe signed

Code Signing Certificate

Organisation:EARNEST PROJECTS INC.
Issuer:Microsoft ID Verified CS EOC CA 01
Algorithm:sha384WithRSAEncryption
Valid from:2025-10-29T11:39:09Z
Valid to:2025-11-01T11:39:09Z
Serial number: 33000518e15b387314896695710000000518e1
Cert Central Blocklist:This certificate is on the Cert Central blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 2a2409f1b0b0a116869fe144eec8be1df3791d6896d73254d742b110983f67ef
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
Bitsight
url: http://178.16.55.189/files/7782139129/F0wtv5v.exe

Intelligence

File Origin
# of uploads :
13
# of downloads :
111
Origin country :
US US
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-10-30 20:28:54 UTC
Tags:
stealer stealc vidar xor-url generic
Link:
https://app.any.run/tasks/79550e7d-a9a3-4958-94a4-3afc0f5a2598

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/34849/
Verdict:
Clean
Score:
82.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6903cd1c9942f1282ecaab50
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Behavior that indicates a threat
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context obfuscated signed threat
Link:
https://www.filescan.io/uploads/6903ca8ede25fddba05dc9fa/reports/ae80ea12-4f94-49aa-937a-a4d7c31b0415/overview
Verdict:
Malicious
Labled as:
Win64/ShellcodeRunner.BKM trojan
Link:
https://www.hybrid-analysis.com/sample/f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-10-30T16:19:00Z UTC
Last seen:
2025-11-01T03:35:00Z UTC
Hits:
~100
Detections:
VHO:Trojan.Win32.Nion.gen UDS:DangerousObject.Multi.Generic
Link:
https://opentip.kaspersky.com/f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1a53b60d-996b-4477-abe5-fcf9084f0cfa
Score:
91%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/f3da2bfd1feccb09f81cce297d33a3f7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-10-30 20:27:08 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ew7qtusbe7a43qkwrddbj3xncivp5kdhr5qa7szb6ixuvjea2fq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/251030-y9hbyatpbs/
Unpacked files
SH256 hash:
f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b
MD5 hash:
f3da2bfd1feccb09f81cce297d33a3f7
SHA1 hash:
892f2a5e99fb8bfd0fd175601b375d9f1554fdfe
Link:
https://www.unpac.me/results/604e85c4-9797-4945-b529-31d1ecc3fa0c/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f92df84e9209/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f92df84e92093e0e6e0ab44630a777689157f5433c7b007e590f917a5524068b

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3691452/
Cape
Cape
https://www.capesandbox.com/analysis/34849/

Comments