MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 13

Intelligence 13 IOCs YARA 22 File information Comments

SHA256 hash:	14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33
SHA3-384 hash:	af6d4b0c5f955fe17114f7a065452bd6542d03d1368987f8632c7a0f1213d947a4610d10f9cc31a19db6d92dbfc56627
SHA1 hash:	05b393e9f08b9ba01b15e8c044ac6c9584530350
MD5 hash:	bb62e6528db0bd70ae254e15c83a3ddc
humanhash:	mississippi-social-oklahoma-table
File name:	RuntimeBroker.exe
Download:	download sample
File size:	2'369'432 bytes
First seen:	2026-11-10 14:10:34 UTC
Last seen:	2026-11-10 14:24:42 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	bb3ac2c21e02c68abcad237dc3fa6d00 (1 x SalatStealer)
ssdeep	24576:xwXpAcdQhe6AWdRZ+cOpxIPItQSaeCI2LrbtXSnIhU/1WrO5/4oE+FutZbJcMFuT:tcdG7AWdRZ+4yL2vX6/rr8C
TLSH	T13AB57B0077E45603DABF47BAD0351960CBB1E597B75BEB8B2D9890BD0D637804E822E7
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	smica83
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

205

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

ReadyToRun

Details

Link:

https://research.acce.ciphertechsolutions.com/results/122912d3-a290-4ee4-8cb1-6c28ab5512a0/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-11-10 18:32:42 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d10a95d6-80f8-48b3-a896-3d11269601bd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99195/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af3260538dc20c444c387fb

Tags:

ransomware injection extens

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating synchronization primitives

Creating a window

Launching a service

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm base64 cmd cmdkey corrupted dotnet evasive explorer fingerprint fingerprint lolbin microsoft_visual_cc obfuscated overlay reconnaissance reconnaissance

Link:

https://www.filescan.io/uploads/6af326024c4315e67204201b/reports/4930be45-eca5-430b-b34a-2456ab983fd5/overview

Verdict:

Suspicious

Labled as:

Spyware/Dacic

Link:

https://www.hybrid-analysis.com/sample/14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e2f0785e-8983-497b-8782-cc2a2cd111b6

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/2003280

Signature

Multi AV Scanner detection for submitted file

Sigma detected: System File Execution Location Anomaly

Behaviour

Behavior Graph:

Download SVG

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

.Net Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/bb62e6528db0bd70ae254e15c83a3ddc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33/

Threat name:

Win64.Malware.Generic

Status:

Suspicious

First seen:

2026-11-07 15:27:47 UTC

AV detection:

6 of 38 (15.79%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ctdolfbcuk7rcq4nqk7yruplrvb7nxlsvh7m4icdrrsepewiluzq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery spyware stealer

Link:

https://tria.ge/reports/261110-rhc5ksga29/

Behaviour

Suspicious use of WriteProcessMemory

Reads the TCP/IP host and domain name from the registry

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Checks computer location settings

Executes a file named after a Windows system binary

Reads user/profile data of web browsers

Malware Family:

n/a

Verdict:

Malicious

Tags:

stealer rat

YARA:

ConventionEngine_Keyword_RAT ConventionEngine_Term_Users ConventionEngine_Anomaly_Slash ConventionEngine_Term_Desktop ConventionEngine_Keyword_Hook ConventionEngine_Anomaly_MultiPDB_Quintuple_Plus Antivirus_strings DiscordStealer BrowserStealer Powershell

Link:

https://app.threat.zone/submission/4e498357-bceb-4169-b0ae-10b27c26a456

Malware Family:

dacic

Malicious:

True

Tags:

file-overlay exe 64bit wmi-activity obfuscated

Link:

https://intel.virussign.com/intelligence/file/14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33

Unpacked files

SH256 hash:

14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33

MD5 hash:

bb62e6528db0bd70ae254e15c83a3ddc

SHA1 hash:

05b393e9f08b9ba01b15e8c044ac6c9584530350

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

401276efe66757efbc9345865fc8a9b2ad2da44b14d0873e1c01df035095af84

MD5 hash:

2f4b61aa924e2776af1bc48456c83229

SHA1 hash:

733a2b4338e9060c4e63b47792fb00e9b9be9be3

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

e2709fda3ee4137dcea3398221f0afcd6241db0ea6fa55fd31a33610be78cf02

MD5 hash:

2a5ab1913bd6f93f3ceca567afa9718a

SHA1 hash:

60e317299ab6b93cc0f003f3507a598525d96cf1

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

c33995427edd44fa641cf702df8b63cc82cb7054dd984dc8277d15ee7c958874

MD5 hash:

e4823410682299e5a17619043c789efb

SHA1 hash:

410d31ca04af5264f265df10de499416225a0962

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

2e7315a35cb86213200654b717f8cbe3c7643a6bec4a106f22fc8c744a94906c

MD5 hash:

da25f1075c746b0f1ef453d43bba2506

SHA1 hash:

750727e9b5c507f28cab8aeaa52d2cc09d57c483

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

b2d6e7e991dc9ef154b29f4966f04fd8ed4ebb2c1d1242ea1d5f3e90f8ae5143

MD5 hash:

e1422b4c04b923dcfe00a55290dc18a6

SHA1 hash:

0609ecde6bc8a87f88bc32b98d19800ff19529b6

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da

MD5 hash:

02c63f568e598aad85dd401d7b26e82a

SHA1 hash:

2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d

MD5 hash:

0bd34aa29c7ea4181900797395a6da78

SHA1 hash:

ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8

Detections:

win_delivery_check_g0

SUSP_NET_Large_Static_Array_In_Small_File_Jan24

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

Parent samples :

c21aa7be1ee9b32dd1d19f84b901f7bcd410584e89b570051a9603e547158d42
e723709ebd1439aa76c850f99d7843b0125f5c8456a53ade128da884e650382e
ee5b17af1bea3ce53b9a6bb09c21f634b9465fe505a01177b9eb33943f3021d3
4e90fa3f4197c83ee858b522e2a99a8145da5e0f972f06a9b825e4a2781dc550
d969b27fdf8e06de8e5a2ee4f853823c26f77e15a54dfc1e8f01920d69aa810f
14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33

SH256 hash:

666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b

MD5 hash:

17ed442e8485ac3f7dc5b3c089654a61

SHA1 hash:

d3a17c1fdd6d54951141053f88bf8238dea0b937

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

29981956955da36990b3cfc93fe50597eeacae669663e230bef519d5693bb2fb

MD5 hash:

d8470d2d8a5b9be3fe660767f1c18f44

SHA1 hash:

6e8fa9038281001cd12c5b27c0183c453c3a5656

Detections:

SUSP_NET_Large_Static_Array_In_Small_File_Jan24

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

6e9cc79431b720be27d9dfcbe070147a0a55fe7a4db205405255c1fba119343f

MD5 hash:

3b696040036b7e85ba4f2d670188ee55

SHA1 hash:

4540fc3bb850c5206f2d7c43cab622a7a47389c3

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

2801c5d7f9e4bdd52b09cf46288218b6868b995d5c30d3373049df1345202b99

MD5 hash:

d06def74c50f860ed9998d4a4b442f32

SHA1 hash:

75f2bc43b6818f56ac5568e6fe2f66163d908c46

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

SH256 hash:

2ca6b9f968fd21152d585c263c5d1e0300cb835e8b186ba0ceaaa8177165350c

MD5 hash:

b69eed0493ecd3a1d53fe26b7d1901be

SHA1 hash:

82fd64949e1e6f0132c923541ba7facf83672c6f

Link:

https://www.unpac.me/results/64f84c09-8a44-4f9a-858f-5277d9e10463/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/14c6e59422a2bf11438d82bf88d1eb8d43f6dd72a9fece20438c644792c85d33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects AgentTesla (inconnu, etat extrait)

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETDLLMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	WIN_Malware_BlakcSeeStealer_ForgeAuto_9b0a0e39_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects BlakcSeeStealer (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_3be2a519 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/99195/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample