🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c4899656aa98daa195ecd372fe4bdeaaa4bec7a59212de2dba415a8b4ea310d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


YapStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 55 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c4899656aa98daa195ecd372fe4bdeaaa4bec7a59212de2dba415a8b4ea310d
SHA3-384 hash: 6c28a578ca8e68e67662bd0fff0285fab4289d691b01cb6750326d5c200c12d180e724e7f9ab86e222e3c477c6896852
SHA1 hash: 45a0874396a6acb3b0e28b74eb8dd4d427ebcd3e
MD5 hash: a86f0faf0e8db1006b19130420ae3535
humanhash: helium-carolina-saturn-nuts
File name:cx-programmer 9.1 free download full_patched.exe
Download: download sample
Signature YapStealer
Create hunting rule
File size:32'522'240 bytes
First seen:2026-10-08 20:57:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash abf73dc5794b54a40e3ea5c9332fa07f (2 x YapStealer)
ssdeep 393216:WzadnaL48SvGv0XhFuwPcY9xgX7ifcIzvr5LKzQS5CP:Wen18Sv60XKwPcg6X7ifhVLJ1
TLSH T1B0679D01B7D84075E2FB3630256AA636663EBD701FE081DB6751B6AE2D71BC19E3031B
TrID 69.4% (.ACM) Windows Audio Compression Manager driver (76501/2/15)
15.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
5.9% (.EXE) Win64 Executable (generic) (6522/11/2)
4.0% (.EXE) Win32 Executable (generic) (4504/4/1)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon d488dcf0b2e886d0 (2 x YapStealer)
Reporter aachum
Tags:de-pumped exe kertc2-website YapStealer


Avatar
iamaachum
https://pulse.metabytevault7.pics/cx-programmer+9.1+free+download+Full.zip

C2: kertc2.website

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
ES ES
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ed3f543c-da7b-4576-a333-04cc57f7824c/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Launching a service
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context adaptive-context anti-debug base64 crypto explorer fingerprint installer-heuristic lolbin masquerade microsoft_visual_cc overlay packed packed packed reconnaissance
Link:
https://www.filescan.io/uploads/6ac803b0eac895cfa61d07cb/reports/a62b2829-4d13-4841-b553-55385a0cfce8/overview
Verdict:
Malicious
Labled as:
Win64/Kryptik.HRN trojan
Link:
https://www.hybrid-analysis.com/sample/0c4899656aa98daa195ecd372fe4bdeaaa4bec7a59212de2dba415a8b4ea310d
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1984535
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Suspicious access to claude desktop data directory by non-Claude process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1984535 Sample: cx-programmer 9.1 free down... Startdate: 08/10/2026 Architecture: WINDOWS Score: 100 31 kertc2.website 2->31 37 Multi AV Scanner detection for submitted file 2->37 39 Joe Sandbox ML detected suspicious sample 2->39 8 explorer.exe 34 7 2->8 injected 12 cx-programmer 9.1 free download full_patched.exe 2->12         started        signatures3 process4 dnsIp5 33 kertc2.website 104.21.4.158, 443, 49713 CLOUDFLARENET-CloudflareIncUS Canada 8->33 41 System process connects to network (likely due to code injection or exploit) 8->41 43 Tries to steal Mail credentials (via file / registry access) 8->43 45 Found many strings related to Crypto-Wallets (likely being stolen) 8->45 53 6 other signatures 8->53 14 chrome.exe 6 8->14         started        47 Injects code into the Windows Explorer (explorer.exe) 12->47 49 Writes to foreign memory regions 12->49 51 Allocates memory in foreign processes 12->51 55 2 other signatures 12->55 signatures6 process7 dnsIp8 35 192.168.2.6, 138, 443, 49709 unknown unknown 14->35 17 chrome.exe 14->17         started        21 chrome.exe 14->21         started        process9 dnsIp10 25 ogads-pa.clients6.google.com 142.250.188.10, 443, 49736, 49739 GOOGLE-GoogleLLCUS United States 17->25 27 play.google.com 142.250.217.142, 443, 49740 GOOGLE-GoogleLLCUS United States 17->27 29 4 other IPs or domains 17->29 23 Chrome Cache Entry: 145, PDP-11 17->23 dropped file11
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0c4899656aa98daa195ecd372fe4bdeaaa4bec7a59212de2dba415a8b4ea310d
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=brejszlkvgg2ugk6zu3s7zf55kvex3d2leqs3yw3uqk2rnhkgegq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery spyware
Link:
https://tria.ge/reports/261008-zrn77sdx7r/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
System Time Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0c4899656aa9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0c4899656aa98daa195ecd372fe4bdeaaa4bec7a59212de2dba415a8b4ea310d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:attack_India
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_all_IPv6_variants
Create hunting rule
Author:Bierchermuesli
Description:Generic IPv6 catcher
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_rule_vldslv
Create hunting rule
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:Win_FakeInstaller_PythonShellcodeLoader_Crepectl_2026
Create hunting rule
Author:SixHands
Description:Detects the analyzed fake installer sample using .key config, XOR key, and Python/fiber shellcode loader traits
Rule name:WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects ACRStealer (pe, etat extrait)
Rule name:WIN_Malware_BlakcSeeStealer_ForgeAuto_9b0a0e39_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects BlakcSeeStealer (pe, etat extrait)
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_3be2a519
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_43faefd2
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_5044a479
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_7e8e91c4
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_92a28498
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_b550d7b4_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_e6a22232
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_f1079127
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_ValleyRAT_ForgeAuto_401c5e16
Create hunting rule
Author:Marjoriefort
Description:Detects ValleyRAT (pe, etat binaire)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

YapStealer

7z 993d4b5f4f4473d63de2fac7184adb8f78b7891e86a2e1b0361ddcb586a27147

YapStealer

Executable exe 0c4899656aa98daa195ecd372fe4bdeaaa4bec7a59212de2dba415a8b4ea310d

(this sample)

  
Link
https://tria.ge/261008-y83w9adv4k/behavioral4
  
Dropped by
SHA256 993d4b5f4f4473d63de2fac7184adb8f78b7891e86a2e1b0361ddcb586a27147
  
Delivery method
Distributed via web download
  
Dropped by
MD5 a05432b0cf14c727c22a91a75380bdc4

Comments