🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0df3202d6a61ec93a8a195f3cdf942a7e2727eb91c9eb71cfe06ddc85187a31c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BRAISUDO


Vendor detections: 12


Intelligence 12 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0df3202d6a61ec93a8a195f3cdf942a7e2727eb91c9eb71cfe06ddc85187a31c
SHA3-384 hash: 3c024febfdf15088e9cdc5b6eba4cdb580ec8173806f279d9641bd69cb36b53d8ffa595b4ec4aedf09f715a6aedfd5d9
SHA1 hash: 011bbfc65db8fafe486d4398af3e856577edc137
MD5 hash: 4da2429b8cde5e987a1f5b63e85e004e
humanhash: may-sad-low-mars
File name:SystemUpdater.exe
Download: download sample
Signature BRAISUDO
Create hunting rule
File size:33'269'530 bytes
First seen:2026-10-27 22:03:06 UTC
Last seen:2026-10-27 22:18:33 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash e3e80a143805ea18936c8f612e25d363 (1 x PyhtonStealer, 1 x PythonStealer, 1 x ValleyRAT)
ssdeep 786432:IdtdHLYNANly7w6L1RrhsqP6bxW2aUg19PzjoS/Zp:Q3HLYNSlyDL1RrfP6U9PXoEZp
TLSH T13F77334642D601A7F4ABF1387947C052D7B2B85127928DAF0B5943CC6DAB2DB2F36722
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon c6c2ccc4f4e0e0f8 (50 x PythonStealer, 32 x Adware.Yogi, 29 x SVCStealer)
Reporter smica83
Tags:BRAISUDO exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
195
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
PyInstaller
Details
Link:
https://research.acce.ciphertechsolutions.com/results/2454a3c1-16a3-4c19-ae3c-c95ca2ee7bb7/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-27 22:13:14 UTC
Tags:
discord ip-check auto-sch python auto-startup auto-reg evasion pyinstaller stealer ims-api generic wmi-base64 openssl tool arch-doc
Link:
https://app.any.run/tasks/ba0cfcee-f9c0-458d-ac02-ba09b52cb09e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae11fb03a56bbccb37bfb18
Tags:
autorun shell virus sage
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug expired-cert microsoft_visual_cc overlay packed packed pyinstaller pyinstaller short-lived-cert
Link:
https://www.filescan.io/uploads/6ae11faa1b89d8d3532dc28d/reports/6f272ecf-443b-41be-8ca2-333ef5c4255f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0df3202d6a61ec93a8a195f3cdf942a7e2727eb91c9eb71cfe06ddc85187a31c
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-27T10:16:00Z UTC
Last seen:
2026-10-29T02:08:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/0df3202d6a61ec93a8a195f3cdf942a7e2727eb91c9eb71cfe06ddc85187a31c/results?tab=lookup
Result
Threat name:
Python Stealer, BRAISUDO Grabber, EICAR
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1993421
Signature
Detected generic credential text file
Drops PE files to the startup folder
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Capture Wi-Fi password
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal WLAN passwords
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Uses WMIC command to query system information (often done to detect virtual machines)
Yara detected BRAISUDO Grabber
Yara detected Generic Python Stealer
Yara detected WIFI Password Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1993421 Sample: SystemUpdater.exe Startdate: 27/10/2026 Architecture: WINDOWS Score: 100 99 discord.com 2->99 101 ip-api.com 2->101 103 api.ipify.org 2->103 121 Suricata IDS alerts for network traffic 2->121 123 Sigma detected: Capture Wi-Fi password 2->123 125 Multi AV Scanner detection for submitted file 2->125 127 5 other signatures 2->127 10 SystemUpdater.exe 181 2->10         started        14 SystemUpdater.exe 2->14         started        16 SystemUpdater.exe 2->16         started        18 SystemUpdater.exe 181 2->18         started        signatures3 process4 file5 81 C:\Users\user\AppData\Local\...\win32pdh.pyd, PE32+ 10->81 dropped 83 C:\Users\user\AppData\...\win32event.pyd, PE32+ 10->83 dropped 91 97 other files (none is malicious) 10->91 dropped 141 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->141 143 Drops PE files to the startup folder 10->143 145 Tries to harvest and steal WLAN passwords 10->145 147 Uses WMIC command to query system information (often done to detect virtual machines) 10->147 20 SystemUpdater.exe 1 40 10->20         started        85 C:\Users\user\AppData\Local\...\win32pdh.pyd, PE32+ 14->85 dropped 87 C:\Users\user\AppData\...\win32event.pyd, PE32+ 14->87 dropped 89 C:\Users\user\AppData\Local\...\win32api.pyd, PE32+ 14->89 dropped 93 96 other files (none is malicious) 14->93 dropped 25 SystemUpdater.exe 14->25         started        95 99 other files (none is malicious) 16->95 dropped 27 SystemUpdater.exe 16->27         started        97 99 other files (none is malicious) 18->97 dropped 29 SystemUpdater.exe 18->29         started        signatures6 process7 dnsIp8 105 discord.com 162.159.135.232, 443, 49742, 49745 CLOUDFLARENET-CloudflareIncUS Canada 20->105 107 ip-api.com 208.95.112.1, 49744, 49747, 49750 TUT-AS-TotalUptimeTechnologiesLLCUS United States 20->107 109 api.ipify.org 104.26.12.205, 443, 49743, 49746 CLOUDFLARENET-CloudflareIncUS Canada 20->109 71 C:\Users\user\...\WindowsSecurityUpdate.exe, PE32+ 20->71 dropped 73 C:\Users\user\AppData\...\system_info.txt, ASCII 20->73 dropped 129 Tries to harvest and steal WLAN passwords 20->129 131 Tries to steal Crypto Currency Wallets 20->131 133 Uses WMIC command to query system information (often done to detect virtual machines) 20->133 135 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 20->135 31 cmd.exe 1 20->31         started        34 cmd.exe 1 20->34         started        36 cmd.exe 20->36         started        42 11 other processes 20->42 75 C:\Users\user\AppData\...\system_info.txt, ASCII 25->75 dropped 137 Tries to harvest and steal browser information (history, passwords, etc) 25->137 139 Detected generic credential text file 25->139 38 cmd.exe 25->38         started        44 8 other processes 25->44 77 C:\Users\user\AppData\...\system_info.txt, ASCII 27->77 dropped 40 cmd.exe 27->40         started        46 9 other processes 27->46 79 C:\Users\user\AppData\...\system_info.txt, ASCII 29->79 dropped 48 3 other processes 29->48 file9 signatures10 process11 signatures12 149 Uses schtasks.exe or at.exe to add and modify task schedules 31->149 151 Uses netsh to modify the Windows network and firewall settings 31->151 153 Tries to harvest and steal WLAN passwords 31->153 50 2 other processes 31->50 155 Uses WMIC command to query system information (often done to detect virtual machines) 34->155 53 2 other processes 34->53 55 3 other processes 36->55 57 3 other processes 38->57 59 2 other processes 40->59 157 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 42->157 61 18 other processes 42->61 63 15 other processes 44->63 65 15 other processes 46->65 67 5 other processes 48->67 process13 signatures14 111 Queries memory information (via WMI often done to detect virtual machines) 50->111 113 Uses WMIC command to query system information (often done to detect virtual machines) 50->113 115 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 53->115 117 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 53->117 119 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 53->119 69 Conhost.exe 61->69         started        process15
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0df3202d6a61ec93a8a195f3cdf942a7e2727eb91c9eb71cfe06ddc85187a31c
Gathering data
Threat name:
Win64.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-10-26 16:54:50 UTC
File Type:
PE+ (Exe)
Extracted files:
828
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bxzsallkmhwjhkfbsxz436kcu7rhe7vzdsplohh6a3o4qumhumoa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery execution persistence privilege_escalation pyinstaller spyware stealer
Link:
https://tria.ge/reports/261027-1yh57sgz8k/
Behaviour
Detects videocard installed
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Command and Scripting Interpreter: PowerShell
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Network Configuration Discovery: Wi-Fi Discovery
Discovers running processes
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Contacts third-party web service commonly abused for C2
Looks up external IP address via web service
Creates a file in the Startup directory
Loads dropped DLL
Reads user/profile data of web browsers
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0df3202d6a61/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0df3202d6a61ec93a8a195f3cdf942a7e2727eb91c9eb71cfe06ddc85187a31c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments