MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e3bdd68f85755b02caa42ec0228fb8a56c964479c4f085eae67569d67440e49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RevStealer

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	2e3bdd68f85755b02caa42ec0228fb8a56c964479c4f085eae67569d67440e49
SHA3-384 hash:	950339039d76ed99b79baedaf9379e9bdd7c19cab9a0db4fd2b8da634cc1689b733cb5bd921a17ee5f91dfee8eb65385
SHA1 hash:	97720939d458970177fc6fda3cecc8d0b2e1947c
MD5 hash:	95670eb4bc08d70b95ebb31d8f1a8ab2
humanhash:	vegan-kitten-echo-iowa
File name:	Installer.zip
Download:	download sample
Signature	RevStealer Create hunting rule
File size:	102'834'593 bytes
First seen:	2026-11-13 10:33:27 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	3145728:idMk8f6nINtbz4NzU/Fh299uTBQ7MyegUVnB7dxja:idMk8f6nINJ05U/m94VMMsC9dRa
TLSH	T1C43833ACF944AA517E023D19E7C92D63B983722807CFDC3D1135DA583758CACB6AB42D
TrID	66.6% (.WIDGET) Konfabulator widget (8000/1/2) 33.3% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	harperjohns
Tags:	RevStealer sideload TradingView version-dll youtube zip

harperjohns

Installer.zip as served from GitLab (102,834,593 B, original lure archive). Contains the legit signed Installer.exe, malicious version.dll and localdata.db plus ~92 MB padding. Delivered via YouTube lure playlists titled 'TradingView Premium/Desktop Crack 2026' (391 playlists, e.g. https://www.youtube.com/playlist?list=PLY7jZ5Cd4EEr8EWE-eChHVRv4_cnA9FAW ; https://www.youtube.com/playlist?list=PLbQo8q1nBk2Js2Z_qUf36wHN_oeirTMat ; https://www.youtube.com/playlist?list=PLCbqT0D9zM3vR2FpTvnxN_RmE86IDnRYT). Their descriptions link to the community post https://www.youtube.com/post/UgkxpTdnpIRi-_-SuwW1TRffXScjGWsxOZ4P by https://www.youtube.com/@JohnyDodep-t8w -> telegra[.]ph/Always-Work-Link-06-26 -> telegra[.]ph/axldxzx-08-10 ('Setup Center') -> gitlab[.]com/ntaylor6960/dwnlnk/-/raw/main/Installer.zip. macOS branch: telegra[.]ph/macOS-05-17 -> curl|bash from toolset17[.]tools -> universal Mach-O stage 2. Chain: Installer.zip = Microsoft-signed OneDrive Installer.exe (legit, d2d792f0...) + malicious version.dll (sideload, b371d2e0...) + localdata.db (193f2597...). version.dll RC4-decrypts localdata.db (key c64749779628799a715a735b60e3df61aaa474f1275503f87e026b2f8d5addfa, fake 'MSCF' header 64 B, payload offset 155, size 433168) and hollows the payload into a suspended process (CREATE_SUSPENDED). Payload c6859833... = REVSTEALER (Elastic REF2859), which carries the Chrome App-Bound-Encryption helper DLL 3c6330d0... (ChaCha20-embedded). REVSTEALER C2/config: queue[.]prooutlet58[.]website:443 (AES-256-CBC in config; needs GET /health containing 'active'); fallback Telegraph dead drop telegra[.]ph/Field-study-willow-atlas-11-05; Polygon contract 0xb6A1834c2F25dD705F18CB2cb17e3713bA8C7E31 selector 0xb4faed39; gate paths */buqpl.ajug; mutex Global\517681F6. More research by the author: https://www.youtube.com/@harperjohnsai and https://youtu.be/UBGt4gP53wU. Static analysis only, nothing executed. -- Harper Johns