MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 244807fd2a661a53498aff35f940dea0caea6dcc8d1244af8c5cce268d23c117. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkTortilla


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 244807fd2a661a53498aff35f940dea0caea6dcc8d1244af8c5cce268d23c117
SHA3-384 hash: ef62953c3a1d406a79e272a4eed99356654cc73c6334682490112d4bfa7863e08ee6d6845cc0eded10dce9b1069f2b8a
SHA1 hash: af31124fe253d0d1307fb85d2a26af499ea6e7c2
MD5 hash: 94735216fc366c3044b9d0e6652986c7
humanhash: moon-solar-william-equal
File name:wfwf.exe
Download: download sample
Signature DarkTortilla
Create hunting rule
File size:2'719'232 bytes
First seen:2025-08-09 01:42:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:qIG4hnFB3BsXZ6bzJskMIcHmfhfKmPleUn/6YqzTVH8BgOtFHYQptDYPIaJLr7Dc:/nOkbzJeIy5a/6NZH8BgO6wcHjTuP
TLSH T16FC54B342AEFA01DF177AF795BD4359BDB6EB673370AA84D1091034B0A22E41DEC153A
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 16c8d8bcbcd8c816 (4 x DarkTortilla, 2 x RedLineStealer, 1 x Smoke Loader)
Reporter aachum
Tags:DarkTortilla exe LabInstalls Stealc


Avatar
iamaachum
http://45.141.233.196/inc/wfwf.exe

Stealc Botnet: ddd
Stealc C2: http://193.143.1.189/3a15c8f9140e7a10.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
47
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
244807fd2a661a53498aff35f940dea0caea6dcc8d1244af8c5cce268d23c117_pw_infected.zip
Verdict:
No threats detected
Analysis date:
2025-08-07 19:07:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/52134ebf-1c86-4a62-9921-3852746b14f8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/19810/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6896a78e1e8a59ee04e7bded
Tags:
virus micro remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/244807fd2a661a53498aff35f940dea0caea6dcc8d1244af8c5cce268d23c117
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a12efd59-4730-482a-9e16-29ee3f4bd81a
Result
Threat name:
DarkTortilla, Stealc v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1753499
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large strings
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected DarkTortilla Crypter
Yara detected Stealc v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1753499 Sample: wfwf.exe Startdate: 09/08/2025 Architecture: WINDOWS Score: 100 35 Found malware configuration 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected Stealc v2 2->39 41 7 other signatures 2->41 7 wfwf.exe 3 2->7         started        process3 file4 31 C:\Users\user\AppData\Local\...\wfwf.exe.log, ASCII 7->31 dropped 43 Found many strings related to Crypto-Wallets (likely being stolen) 7->43 45 Writes to foreign memory regions 7->45 47 Allocates memory in foreign processes 7->47 49 2 other signatures 7->49 11 AddInProcess32.exe 13 7->11         started        15 AddInProcess32.exe 3 7->15         started        17 AddInProcess32.exe 7->17         started        19 2 other processes 7->19 signatures5 process6 dnsIp7 33 193.143.1.189, 49703, 80 BITWEB-ASRU unknown 11->33 51 Found many strings related to Crypto-Wallets (likely being stolen) 11->51 53 Writes to foreign memory regions 11->53 55 Allocates memory in foreign processes 11->55 57 Found direct / indirect Syscall (likely to bypass EDR) 11->57 21 conhost.exe 11->21         started        23 chrome.exe 11->23         started        25 chrome.exe 11->25         started        27 chrome.exe 11->27         started        59 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->59 61 Injects a PE file into a foreign processes 15->61 29 AddInProcess32.exe 15->29         started        63 Switches to a custom stack to bypass stack traces 17->63 signatures8 process9
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/244807fd2a661a53498aff35f940dea0caea6dcc8d1244af8c5cce268d23c117
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/244807fd2a661a53498aff35f940dea0caea6dcc8d1244af8c5cce268d23c117/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-08-07 14:49:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
110
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ereap7jkmynfgsmk7427sqg6udfou3omrujejl4mlthcndjdyelq._file
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:darktortilla family:rhadamanthys family:stealc botnet:ddd crypter discovery loader stealer
Link:
https://tria.ge/reports/250809-b4zbyawlx4/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Darktortilla
Darktortilla family
Detects Darktortilla crypter.
Detects Rhadamanthys Payload
Rhadamanthys
Rhadamanthys family
Stealc
Stealc family
Malware Config
C2 Extraction:
http://193.143.1.189
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d33445b6-e910-46f5-ba6e-2eeee05ebf8d
Unpacked files
SH256 hash:
244807fd2a661a53498aff35f940dea0caea6dcc8d1244af8c5cce268d23c117
MD5 hash:
94735216fc366c3044b9d0e6652986c7
SHA1 hash:
af31124fe253d0d1307fb85d2a26af499ea6e7c2
Link:
https://www.unpac.me/results/a41c4a54-c069-4fe0-86b2-e3374475d692/
SH256 hash:
2c4651a093a276841935a5b85856ee323d618a60d02162517c9f828c5e3e686d
MD5 hash:
fc1c04e172f708bcfdcaac1d723703bc
SHA1 hash:
12b2a6fc9e88ceba38c90d3a39e09315f1ab93a7
Link:
https://www.unpac.me/results/a41c4a54-c069-4fe0-86b2-e3374475d692/
SH256 hash:
b93bebd7f42919ccf2f07d84da350fd77d111485ed44391cbca6af70b50036bf
MD5 hash:
f78e095892191a48f2848f8372f65a87
SHA1 hash:
0fbad02a10028e049498ba8b11f49ac82c4214ae
Link:
https://www.unpac.me/results/a41c4a54-c069-4fe0-86b2-e3374475d692/
SH256 hash:
af8a8cbbae0a6d042087f347d116b46554b163613393acf2049790c42974483b
MD5 hash:
b1322cdcf8860f117902b56cf9949637
SHA1 hash:
3e9d25ea1120032d889710effc5b0b8af4c53926
Detections:
stealc
Create hunting rule
Link:
https://www.unpac.me/results/a41c4a54-c069-4fe0-86b2-e3374475d692/
SH256 hash:
43c507f5b0a484afbf28045d71334d73002936d83de7413b22a76e8193867357
MD5 hash:
43760cde65e222144cbe4c68fbcf348f
SHA1 hash:
63980594a192df07174d907bb2d5e06a2bbadcab
Link:
https://www.unpac.me/results/a41c4a54-c069-4fe0-86b2-e3374475d692/
SH256 hash:
da4cb91d96214c7134a9e8799fdf241bd6b8103eecd4efb1b8c228ca3c8e7e91
MD5 hash:
9a06e083cd0531927dcd616b9b601ffa
SHA1 hash:
9584f7e1c8ab7be5900762abcaedf20cb92e4ae7
Link:
https://www.unpac.me/results/a41c4a54-c069-4fe0-86b2-e3374475d692/
SH256 hash:
2cb5b8fbcd0994c8371837858c1f6dfe8e0de017e86437c7aee38d710209f10a
MD5 hash:
4f5880d558000b383fbb6efb21100997
SHA1 hash:
d2ceb9140d797b0f4db46a0a02c274e4fe89f349
Link:
https://www.unpac.me/results/a41c4a54-c069-4fe0-86b2-e3374475d692/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/244807fd2a66/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/244807fd2a661a53498aff35f940dea0caea6dcc8d1244af8c5cce268d23c117

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkTortilla

Executable exe 244807fd2a661a53498aff35f940dea0caea6dcc8d1244af8c5cce268d23c117

(this sample)

  
Link
https://tria.ge/250809-br9bdafm5v/behavioral1
  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/19810/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments