MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a
SHA3-384 hash: 9fe8e57d74bb8b1b32d184b600117a0609ed0c6751343ddf4551db11a88e15f6fc0bb9dadeb5b363e9e0327c540a426f
SHA1 hash: fc89313c0ca3c45a1f542c82e55aa0a3443fff4b
MD5 hash: 3329c3cb960e2525078368a84faa545a
humanhash: island-washington-ceiling-white
File name:b8drttr7dp.exe
Download: download sample
File size:3'316'400 bytes
First seen:2026-07-11 09:00:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00bb7fce5ec272a3f42206b736cf4a00
ssdeep 98304:T0MjhwCO55NRhueydKoRHcT6DyUT0DyBEK:Tn965NRhPyoo5cT6GUTwy/
TLSH T1C0E501037F18D842D55A1E318934CBF96361FD98AA59438B34DABF1BFDE81D2AE021D4
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 30e8c8b0a0c0e070
Reporter EricParker
Tags:EtherHiding exe ogstealer signed Themida

Code Signing Certificate

Organisation:Start Menu Pin Cleaner, O=SpringLine Wind Apps, Inc., OU=Software Publishing, L=Vancouver, S=BC, C=CA
Issuer:Start Menu Pin Cleaner, O=SpringLine Wind Apps, Inc., OU=Software Publishing, L=Vancouver, S=BC, C=CA
Algorithm:sha256WithRSAEncryption
Valid from:2026-07-07T18:50:46Z
Valid to:2029-07-07T19:00:46Z
Serial number: 5d93a6d20ce438894b3647e77f7cd793
Thumbprint Algorithm:SHA256
Thumbprint: 826499f57278defb24d9ad1d8b833d41484d38b15dc0bdc1fd00b92d97b026a0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
atEricParker
An interesting new piece of malware I call OGStealer due to it's odd behavior of targeting bytecoin, namecoin and other long forgotten cryptocurrencies, but also using modern techniques like etherhiding. Themida packed but core functions are not virtualized, gpt 5.6 sol can unpack it.

Shipped as 'resight cheats' in an electron + NSIS packer.

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
TH TH
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
b8drt_extracted_password_infected.zip
Verdict:
Malicious activity
Analysis date:
2026-07-10 07:34:58 UTC
Tags:
arch-exec arch-doc
Link:
https://app.any.run/tasks/46bb60a6-a8bb-4789-a136-6c42c08a8af2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74232/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a52064ba900f0e9eb6c01c5
Tags:
injection packed virus
Result
Verdict:
Clean
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed packed signed themidawinlicense
Link:
https://www.filescan.io/uploads/6a52064400114a8c1d1c8088/reports/39c6a446-e7c1-4bfb-b219-bbae690d7427/overview
Verdict:
Malicious
Labled as:
W64/Themida.DK.gen
Link:
https://www.hybrid-analysis.com/sample/1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a
Verdict:
Clean
File Type:
exe x64
First seen:
2026-07-08T02:10:00Z UTC
Last seen:
2026-07-12T23:39:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/29e135cd-0aef-415d-a788-fd863ff547ee
Score:
48%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/3329c3cb960e2525078368a84faa545a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-07 22:44:37 UTC
File Type:
PE+ (Exe)
Extracted files:
6
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=drzl5yt3zccwh2pxjjdnz56rdhumzrgiqajddl242kj4l5mtcbna._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion themida trojan
Link:
https://tria.ge/reports/260711-kyq8tagx6t/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Checks whether UAC is enabled
Checks BIOS information in registry
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a
MD5 hash:
3329c3cb960e2525078368a84faa545a
SHA1 hash:
fc89313c0ca3c45a1f542c82e55aa0a3443fff4b
Link:
https://www.unpac.me/results/2d26080b-e6ce-4ef8-8ac6-20fa74115c13/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/3a6c2c04-e82c-46da-8f87-9522846a1df5
Cape
Cape
https://www.capesandbox.com/analysis/74232/

Comments