MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13fa7d9111462ae97d2d41e6879b0d3ee2ed5f8ec939dec4e56bd209e1e85b1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	13fa7d9111462ae97d2d41e6879b0d3ee2ed5f8ec939dec4e56bd209e1e85b1a
SHA3-384 hash:	972d63a3bfb74b34d389c1f9c3f9a21c6662abf3a30a1a0402d92bdd20c9fc1e5d3d0c951edc006aac1ed27c18aa7854
SHA1 hash:	018b2ec69b4db026a1121cdfda6d4f3f157c822c
MD5 hash:	3a86f0eec0a8e2be0dd62f1a7b755d8d
humanhash:	monkey-table-don-butter
File name:	n3k8r1p0zu.exe
Download:	download sample
Signature	Stealc Alert Create hunting rule
File size:	83'017'835 bytes
First seen:	2025-12-03 14:31:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	75cf84d4df4a91bcc923afe606315555 (1 x Stealc)
ssdeep	393216:+mtDmI1r26dJZZ0T9Fr5phInzYivPfq0OdNeQcQu58EASEhoIaE2lShGD1BE6xqk:+EjlCtcQJhU5ZqoVNWvxOOxoh8U
TLSH	T1DE086B4667EA04D4F9F79A749AE65213C673BC063F30D5CB3208172A1F736E09A7A721
TrID	33.6% (.EXE) OS/2 Executable (generic) (2029/13) 33.1% (.EXE) Generic Win/DOS Executable (2002/3) 33.1% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
dhash icon	07e8ccd4d4d4c003 (1 x Stealc)
Reporter	burger
Tags:	exe Stealc stealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

171

Origin country :

NL

Vendor Threat Intelligence

ACCE MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ab5bf88c-8b74-42fb-bc90-69d7a254c48b/

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

n3k8r1p0zu.exe

Verdict:

Suspicious activity

Analysis date:

2025-12-03 14:30:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3377256c-0217-4d4d-ab7f-e1f41c6422a5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6930497116e6db515e464cba

Tags:

n/a

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file

Sending a custom TCP request

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm crypto expand fingerprint installer-heuristic lolbin microsoft_visual_cc nexe overlay overlay packed packed

Link:

https://www.filescan.io/uploads/69304a0b37f663155c362be1/reports/546f3632-1076-4d31-a90e-9ef103c10de6/overview

Hybrid Analysis Trojan.Heur

Verdict:

Suspicious

Labled as:

Trojan.Heur

Link:

https://www.hybrid-analysis.com/sample/13fa7d9111462ae97d2d41e6879b0d3ee2ed5f8ec939dec4e56bd209e1e85b1a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-12-03T11:34:00Z UTC

Last seen:

2025-12-03T20:23:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan-PSW.Win64.Stealka.gen

Link:

https://opentip.kaspersky.com/13fa7d9111462ae97d2d41e6879b0d3ee2ed5f8ec939dec4e56bd209e1e85b1a/results?tab=lookup

Joe Sandbox EICAR

Result

Threat name:

EICAR

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1825479

Signature

Antivirus detection for dropped file

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

PowerShell case anomaly found

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Yara detected EICAR

Yara detected NexeCompiled Binary

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

78%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/13fa7d9111462ae97d2d41e6879b0d3ee2ed5f8ec939dec4e56bd209e1e85b1a

CERT.PL MWDB

Gathering data

Neiki Trojan-PSW.Win64.Stealka

Verdict:

Malicious

Threat:

Trojan-PSW.Win64.Stealka

Link:

https://tip.neiki.dev/file/13fa7d9111462ae97d2d41e6879b0d3ee2ed5f8ec939dec4e56bd209e1e85b1a

ReversingLabs TitaniumCloud Win64.Malware.Heuristic

Threat name:

Win64.Malware.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-03 14:30:05 UTC

File Type:

PE+ (Exe)

Extracted files:

243

AV detection:

7 of 24 (29.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cp5h3eiriyvos7jnihtipgynh3ro2x4oze455rhfnpjatypilmna._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251203-rwmwyazmhv/

Behaviour

Checks processor information in registry

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1845abad-1efb-45ef-a498-bd91a76d9c24

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.