🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GOBackdoor


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c
SHA3-384 hash: 03a20ea4e68852f2aff2116fc293aa2719c23290ea6a37a2dad84af5dafed939164d5b90a06abc3c927d441c8d935f08
SHA1 hash: 0f8aafc5808faa6efc4ba8ef98b8880f256fb101
MD5 hash: 59c1b29677ef1ac61bc12fec9d8cd816
humanhash: connecticut-violet-steak-india
File name:schd.dll
Download: download sample
Signature GOBackdoor
Create hunting rule
File size:12'524'112 bytes
First seen:2025-09-17 18:22:05 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 7cebca2b4869e885be5d2060bc9f5e88 (1 x GOBackdoor)
ssdeep 24576:rFedDJa5W6btzDTxOU4ZZIi5W0LM1VS4rK3mUe4s4T7cZ8Gz1Uq3OUts2BKEzj9Y:rFYa5W6BnTxOKWN
TLSH T18EC65C776FB1AC42CBCB02775DA66F980EEE4731418A70C9D1AB42C00557AF7EA0E52D
TrID 30.2% (.EXE) Win64 Executable (generic) (10522/11/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4504/4/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter aachum
Tags:dll dropped-by-ACRStealer GOBackdoor signed

Code Signing Certificate

Organisation:Qihoo 360 Technology Ltd
Issuer:Qihoo 360 Technology Ltd
Algorithm:sha1WithRSA
Valid from:2018-12-31T23:00:00Z
Valid to:2098-12-31T23:00:00Z
Serial number: -3b26472c3736bf62bd782c8675aaece1
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 355f429b04060c796462ef121e9a0809128642526da08519b9f9e056767cdb0d
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
iamaachum
http://mi.raisindispose.com/kaWt2QXfpPueNM/F.ct/schd.dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
ES ES
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27988/
Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cafc7e88b9544392475be7
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug anti-vm mingw packed redcap signed
Link:
https://www.filescan.io/uploads/68cafc7a5ebd1d861ec4d669/reports/72658a21-b335-414c-b64c-9474544c487c/overview
Verdict:
Malicious
Labled as:
Trojan.Druid
Link:
https://www.hybrid-analysis.com/sample/2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c
Verdict:
Malicious
File Type:
dll x32
First seen:
2025-09-17T15:28:00Z UTC
Last seen:
2025-09-17T15:28:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan.Win32.ExShell.gen
Link:
https://opentip.kaspersky.com/2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c/results?tab=lookup
Malware family:
Driver Support
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/4aa5bb6b-aa40-4433-b268-419525c2be92
Result
Threat name:
GO Backdoor
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1779495
Signature
AI detected suspicious PE digital signature
Antivirus detection for URL or domain
Connects to many ports of the same IP (likely port scanning)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected GO Backdoor
Behaviour
Behavior Graph:
Download SVG
Score:
20%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/59c1b29677ef1ac61bc12fec9d8cd816
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c/
Verdict:
Malicious
Threat:
Trojan.Win32.ExShell
Link:
https://tip.neiki.dev/file/2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c
Threat name:
Win32.Trojan.Druid
Create hunting rule
Status:
Malicious
First seen:
2025-09-17 18:24:18 UTC
File Type:
PE (Dll)
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fvezoahbggozea7delfr5cum73ckvgl7q3i7z53bk3h2uctsavga._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery
Link:
https://tria.ge/reports/250917-wz81ssbj2w/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Badlisted process makes network request
Unpacked files
SH256 hash:
2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c
MD5 hash:
59c1b29677ef1ac61bc12fec9d8cd816
SHA1 hash:
0f8aafc5808faa6efc4ba8ef98b8880f256fb101
Link:
https://www.unpac.me/results/427b080f-6f78-4afd-b90d-f2b8dca0c284/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GOBackdoor

DLL dll 2d499700e1319d9203e322cb1e8a8cfec4aa997f86d1fcf76156cfaa0a72054c

(this sample)

  
Link
https://tria.ge/250917-wxfw8stzcw/behavioral2
  
Dropped by
ACRStealer
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/27988/

Comments