🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kamasers


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6
SHA3-384 hash: 2dbffcf2393eef59ede6fe4815672d802f09359a06cf02b979bb345e1eeaa0b60a8ceaad4b89418690f7fc6e4fd0a1ef
SHA1 hash: 8e7469900ad9b5ba4140fc2bdcb76c4957d996a5
MD5 hash: 675a7ad76f67d05d1f05be24b7f70db3
humanhash: solar-six-arkansas-uniform
File name:675a7ad76f67d05d1f05be24b7f70db3.exe
Download: download sample
Signature Kamasers
Create hunting rule
File size:1'686'456 bytes
First seen:2026-10-25 10:46:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (103 x LummaStealer, 85 x RedLineStealer, 63 x Rhadamanthys)
ssdeep 49152:uv/CSU/SKSc36O+W7cB0ICGS476COxKrkzv:uxYSA36Gc6u6COKW
TLSH T13875232217F844A6D875133594B697A38230794B7B39DE9F2399D89D3F63AC0B03835B
TrID 45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
18.0% (.EXE) Win64 Executable (generic) (6522/11/2)
13.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.ICL) Windows Icons Library (generic) (2059/9)
5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon 9694b37676783434 (1 x Kamasers)
Reporter abuse_ch
Tags:exe Kamasers

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
Archives AutoIt
Details
Link:
https://research.acce.ciphertechsolutions.com/results/04881822-22a5-41e7-b5b6-e59405a69415/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-24 16:21:02 UTC
Tags:
gcleaner loader auto generic autoit auto-startup salatstealer stealer github botnet kamasers udados susp-powershell golang delphi auto-reg upx
Link:
https://app.any.run/tasks/26eb9bd5-e4fb-44f6-9311-ff3ecae503af

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/94428/
Detection(s):
SecuriteInfo.com.Trojan.Agent.17860.18982.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6addde405a22ac805bda0071
Tags:
autorun autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Launching a process
Creating a process with a hidden window
Creating a process from a recently created file
Creating a window
Creating synchronization primitives
Creating a file
DNS request
Sending a custom TCP request
Sending an HTTP GET request to an infection source
Connection attempt
Sending an HTTP GET request
Searching for synchronization primitives
Deleting a recently created file
Unauthorized injection to a recently created process by asynchronous procedure call
Query of malicious DNS domain
Connection attempt to an infection source
Enabling autorun by creating a file
Deleting of the original file
Sending an HTTP POST request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit CAB expired-cert explorer fingerprint fingerprint installer installer installer-heuristic invalid-signature keylogger lolbin microsoft_visual_cc packed reconnaissance rundll32 runonce sfx signed
Link:
https://www.filescan.io/uploads/6addde3af7ac7cdbe3a87143/reports/3104cb77-7705-4aac-a78b-45b623136474/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-24T16:55:00Z UTC
Last seen:
2026-10-24T19:22:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bb82720a-d8f8-4541-afdb-4d4d090b701f
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1991357
Signature
Accepts controller-supplied payload-download tasks
Antivirus detection for URL or domain
Deletes itself after installation
Found API chain indicative of debugger detection
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Performs DNS TXT record lookups
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Unusual module load detection (module proxying)
Uses ipconfig to lookup or modify the Windows network settings
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1991357 Sample: 99QxV9dtRg.exe Startdate: 25/10/2026 Architecture: WINDOWS Score: 96 35 pitbul.ninikima.com 2->35 37 ideas-irisselection-irisfd-lb.prod-ncus.ideas-irisselection-irisfd.northcentralus-prod.cosmic.office.net 2->37 39 5 other IPs or domains 2->39 53 Antivirus detection for URL or domain 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 Accepts controller-supplied payload-download tasks 2->57 61 2 other signatures 2->61 8 99QxV9dtRg.exe 4 2->8         started        12 wscript.exe 2->12         started        14 AutoIt3.exe 2->14         started        signatures3 59 Performs DNS TXT record lookups 35->59 process4 file5 33 C:\Users\user\AppData\Local\...\AutoIt3.exe, PE32 8->33 dropped 63 Uses ipconfig to lookup or modify the Windows network settings 8->63 16 AutoIt3.exe 6 8->16         started        20 ipconfig.exe 1 8->20         started        65 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->65 22 AutoIt3.exe 12->22         started        signatures6 process7 file8 29 C:\Users\user\AppData\Local\...\Cogitate.vbs, ASCII 16->29 dropped 31 C:\Users\user\AppData\Local\...\AutoIt3.exe, PE32 16->31 dropped 45 Found API chain indicative of debugger detection 16->45 47 Deletes itself after installation 16->47 49 Queues an APC in another process (thread injection) 16->49 51 2 other signatures 16->51 24 AutoIt3.exe 18 16->24         started        27 conhost.exe 20->27         started        signatures9 process10 dnsIp11 41 158.94.208.81, 49710, 49711, 49712 OMEGATECH-ASSC Germany 24->41 43 boalysys.com 104.21.69.35, 443, 49713 CLOUDFLARENET-CloudflareIncUS Canada 24->43
Score:
49%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6
Verdict:
Stealer Crypter
YARA:
7 match(es)
Tags:
AutoIt CAB:COMPRESSION:LZX Commodity Crypter (imphash) Decompiled Executable PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) Stealer Crypter Stealer Loader Suspect T1027 T1027.001 T1055 T1140 Win 64 Exe x64
Link:
https://app.malva.re/file/675a7ad76f67d05d1f05be24b7f70db3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6/
Threat name:
Win64.Backdoor.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-25 00:57:49 UTC
File Type:
PE+ (Exe)
Extracted files:
67
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bfnkvi6ntozxd24rerjoukow2exja76njj6nz377dzcgoxb3wt3a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery persistence privilege_escalation
Link:
https://tria.ge/reports/261025-mw2ymszshx/
Behaviour
Gathers network information
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Checks computer location settings
Creates a file in the Startup directory
Deletes itself
Executes dropped EXE
Downloads MZ/PE file
Unpacked files
SH256 hash:
095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6
MD5 hash:
675a7ad76f67d05d1f05be24b7f70db3
SHA1 hash:
8e7469900ad9b5ba4140fc2bdcb76c4957d996a5
Link:
https://www.unpac.me/results/ae4e6a09-982c-486d-b9c4-352f1b3d901f/
SH256 hash:
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 hash:
0adb9b817f1df7807576c2d7068dd931
SHA1 hash:
4a1b94a9a5113106f40cd8ea724703734d15f118
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/ae4e6a09-982c-486d-b9c4-352f1b3d901f/
Parent samples :
7cdd2a796b1b8de7131deadb7a9d6b348d321ce6b7af022124b0826166f70c18
333d68c6bff4c107f9f4b95c51c5471aa56c03469d8d155bd949902ada3af5fa
db9737257fac05121420a708b7d32413086f06824152969883dbf04a23e8137d
7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e
a7d30ea8eb070eddffb46afd3b839c4af00021f0dd33352e36ef1173502bac11
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
4fba27b378c3aeab8e9f98899e8d13ed36c61039b023af9388fb3056ef894f59
8057475293e725d1b81a46eb5196aa468fa2d67af28ec220908ac89153381f95
e0ee7fe891f5d36b1b41e16f94c53a99e74c81ac3b721b639867fb0a5043c99b
282b43f40f8670d673e45bba045f21d498cd5a857c36a27be13acae669e90120
e8747d7ab6ce57aee41a7085c16d08e55441ae0a8a88a49d9fab903ed07ac888
62a89602c9e4fdf606690b19290c75ca012a3308e044a522fb019654a8780bd4
6c13b65c7ffaef21388c60cc2be3370b35a729eb9e8986ce1abd3303e144896f
490aa9aa3053f1eaba17713ac5f334e94271e979a56ebc4d3f9cfb61d78f66d5
a1cafe0d39cc17c0e36db2afdb4f640e3e81da7b2302c01e03c96348723ffdc9
aee72e1441fa3c9ea74409e5e670e10dbf86e1663f6d6a9dc11fd97e7dec6030
16b2851cd765c313395a3cba2a38a16d4338ef32bb68e5c13320494b3c84c52a
5f58e87fee021cbaa9ecfae2d5f8709bd0934b2d2d2779a8f24993425fb20350
6d414885d7f75777705948ed9a7134421d7cc2eabb4c4591b913864e8642850a
f9b5af130a858971c48de2b78ac57dc335d2e5fa905887ab0e058c083cfc5fe3
1e847cccbb36b7d28db70aeedede580bab5721a1da53b9296b1c4e13b344c313
c23b7950208b8f8e8a22c401cb5e9a05e560ae6119307d975ba601b4e2e99273
e5bcb2a1cdf6cab62da5b7c8e8d78c25acb5627be5028fd5499df561fd4f24df
f3c0f469753fe8f40c2f45cee815d8afb9fa2b54f2b6a32a14bf3dd1db56f3b7
807ccda4477aa254715390adcb32600ec28e9b601cc1c66d94d5d4a8fd72593d
5e124622c393c00a23222f7d61e5680a6572c7fe6db6412ac631b8cdfb56f339
6678bc6c477241fda05929d12aa57d80511f56bde4c16eaba2338b7ae039dd2f
4ee8706cd6bf820a75a528e933d35a306ac18d466cc989a3317be9f5be9c1e5e
e037b1be05a5def69a7692aef31446093ef7c4190215af0a6d742f4724fb1fd3
9051f50868b433bf7b8fb2c35956bd87deff78c6b3f4ce06986956aa46dc161e
ffc9154b06d3288a4e30383c92b53ac10d9f617bfebd5b6cd9bd8aef91acfd12
a625ecad0006b950b07194830e7f33e7e820ac29ab8d8d90305f7bf441c0803e
83f196de27b44807a2c4697ebe19b7995971e7dbf6d09a9dbc0c91076b47a6a1
52a189781402d404196a0bd74055e8322915aa4a00b37ac0f1ef06e2c7a91d74
2d4a0802f338b3b4a174963bbb8e76c13ef958a42265f51af1f746736c6c8451
17b48e9aa4ea6dc0b97d9d4233806960051c384281a34fd0ec23dc4f3cb30250
7df40b776f6b6c0d3e904a5f4e459aceb74cdfaeaed506702fb3e3cebc0acde3
4cea2d681b946622831d5aabe52bea6be9a92dd70a1725f4f21c7af87bc30b8d
9e1a61c477a77c8d3429f2332c6ac7f9cbf7acc7d0f760f30067b5b2ba9c32f7
e9dd17079ef1906ec63ae75676a703731a1a0b235abf8604630d0f52b44b5088
488c6c4ea3ea6021ef5f344aa958fad9e977958533c4d48ce923b6410679ffc1
4c8de5fe1cd25f11cacfd4aae14eb69a3579cf210d9135fd5a2eed1dfc7798f3
a54764e6c1d020ee0c9b2184cc1b7697a7a86d9e9126c7cabef65a6576fc4893
3fc87dc91ea3a28c0b71dd59cfbf92ac4f27fe1d1e682dac03198fd07ad8d4c1
02aafe6e13fc993f38f7c81ca8d3560ca596d5189984550ff293f6a998c7bb40
de0ad26e3d33b27e4486440745067ba3aa765dfe8ee35d759229ae83473bd669
1dad6cb984f93799b594024aad10191ae1374d53670e132b75abffb89848ae46
bac991e38b4e9ac602cb939fdbffb4213ed6dbfa1d5b170c28cad6e5b3d5c83d
057c2a603337cc33567f32aa4e793e5b1975715b18dd71200f6785b740d95394
b062569dc998c1decbde7acc61c10c5aa751e3eeaed8abe43fc5e2d930ae68b2
e003206e4b468d128c3e9a3cced6def52784b5dd6efda81f30107eee1af2b265
6c292a1785ee86d820b7cd804efe7ae31b179cbab3a99fed8c5fccb1e2750936
4ca06ee3340b192b3ca3ff2d08ab69f3753c6a805c2db18ef81303d7beeb7d68
6962ecb3e9c43b067ef6f3e6a445d8110f24165c3dd5704b3d2cc85fc3b65ba7
dabdfe0696d886914b534e0f90d81627113409ec8b3f3cdcad0aebd2e5bc8aea
ead56795ab3c2106e9618fa6cafcece2a0bbd1ab7ad7daba386df21d45aa67dd
b9cb9cf246d2d9d8a4bff2d7758267af69bcb1f3179d104d66eb0a73e54ab524
12a45143a35ee31f3e9c92deb6377873b3aaf360aab15bd606d347bedd0a2378
da1140a4d3a9c65f836af07667be9ebe4dc54e0dfbc29143be53ef160e36c910
785b0ccf655723dd52136a60a8389adfa5445bd1cbd53d5e80e7be26124e54a3
ef32abda2c3d6013ebe526a20bc266e62311794aedd673dc58e1c60a078ef92f
5f4710bfecf96b1c4c9ef95b36543b698b2e89682f1a8524927ed860de826f8b
a2d004f78528c839119532cff09cf6f777baea9b1680d69eeb82d6a7700690db
b08379185071a9e03f72b26a72df69ebb819cb7b9994048df1ccd12449b1c357
3d1b3ea691122f9c332232b8c8e6541c431b74b783e317189e3ddaab8f864b62
e73fa583da7adc97a772826ce26e16ed0b95e4193a36382a2e69e148fbd4dea1
45dec334575199a17f733f0001e315d55e9836fdc9508f8983fbfb2d20e739c1
40003c0707a0d639b8e27d01ac0a31b73579d5e7a79077002f8005932b94e836
967486f372064f8edc8695c91660fe436dadb2cd848a251268c8002fccd4f45c
8910f0cb2eb97c3b1ced8b512bb34884a958ba7d81829841b2e60eb487157662
19bfcd76cdb9d7a411be713c7494d953759fe4301a33a6a89254afff1f87cbb6
736dedb3dc80fc3c7e584666082ff8ff9673a4356f5d88f85165792086e93c1d
105195dfdfbfdce7cf13f50d92bba761eba5bc22c31000109a67708f61474e12
d723c473068e3a1ab8b326d3f42b62e20d460d01e4ed8b944e42b0dc6effbb37
31dc572984be0c27e1387ddda3394b4243ba96d0a2ca1efac4891948eee8f3d4
ae84577951a74e41e51851bddbe82bbb591fdaa973b6d54b5a4f3b7da419d495
146d14867b448876ca823c0902ee4a3689282d0a4b5b9df15633d85c9f4c782f
095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6
ce27b29de2bc3fdf1d67620abb0c5502720312507fe3a0b237bad8070c86a450
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/095aaaa3cd9bb371eb912452ea29d6d12e907fcd4a7cdcefff1e44675c3bb4f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_Unknown_ForgeAuto_b550d7b4_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/94428/

Comments