MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fc6f2fd32d630c1202fed63c8a1b32b7046f89162ffc568c0f802ac6441354d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PythonStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fc6f2fd32d630c1202fed63c8a1b32b7046f89162ffc568c0f802ac6441354d
SHA3-384 hash: 4c04f6048dcafda78d176a780a51bc7bd2be87b7ca708ce87e05a23ef2ca39beba25dc9b91f24cc73cff4d0ae577f9e4
SHA1 hash: cecb997415c6f82cf07e03e7d566e6d02776e299
MD5 hash: 25e25919a594c7cc9627be53a244235a
humanhash: whiskey-kentucky-kansas-snake
File name:lobotomyREMAKE.exe
Download: download sample
Signature PythonStealer
Create hunting rule
File size:18'229'473 bytes
First seen:2025-08-21 23:29:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 351592d5ead6df0859b0cc0056827c95 (6 x PythonStealer, 3 x BlankGrabber, 2 x DiskWriter)
ssdeep 393216:V1Dds8pCTOuQH3z1Ddd2ETaDvV+53SM8+DjfPjSD8BWzOA:V1JAHQH3z1J0EIvV/M8+vP2D8BWz
TLSH T1FF0733049AA004FFE4A2E53BC54BDC305772FA433FA7C49B07D559522D2B6845A3A3FA
TrID 66.6% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10522/11/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aebc385c4ce0e8f8 (13 x PythonStealer, 7 x RedLineStealer, 7 x DCRat)
Reporter AntiSkidding
Tags:exe Python PythonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
lobotomyREMAKE.exe
Verdict:
Malicious activity
Analysis date:
2025-08-21 23:31:31 UTC
Tags:
python pyinstaller
Link:
https://app.any.run/tasks/3f7a9e37-0e2f-4057-a73a-0da1e677ebe0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/22859/
Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a7abeb8fd55a79c529e871
Tags:
installer extens virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm expand fingerprint keylogger lolbin microsoft_visual_cc overlay overlay packed packed pyinstaller pyinstaller threat
Link:
https://www.filescan.io/uploads/68a7ac022a70220b68d85470/reports/6ae8b5b0-6acf-4fe3-a456-6116ee1559e2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/2fc6f2fd32d630c1202fed63c8a1b32b7046f89162ffc568c0f802ac6441354d
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2fc6f2fd32d630c1202fed63c8a1b32b7046f89162ffc568c0f802ac6441354d
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/25e25919a594c7cc9627be53a244235a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2fc6f2fd32d630c1202fed63c8a1b32b7046f89162ffc568c0f802ac6441354d/
Verdict:
Susipicious
Link:
https://tip.neiki.dev/file/2fc6f2fd32d630c1202fed63c8a1b32b7046f89162ffc568c0f802ac6441354d
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-08-21 03:59:23 UTC
File Type:
PE+ (Exe)
Extracted files:
971
AV detection:
8 of 24 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f7dpf7js2yymcibp5vr4rintfnyen6erml74k2ga7abkyzcbgvgq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/250821-3gvtsaxzet/
Behaviour
Checks SCSI registry key(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/21e8b425-236f-43ab-92a3-935d29bcd6ad
Unpacked files
SH256 hash:
2fc6f2fd32d630c1202fed63c8a1b32b7046f89162ffc568c0f802ac6441354d
MD5 hash:
25e25919a594c7cc9627be53a244235a
SHA1 hash:
cecb997415c6f82cf07e03e7d566e6d02776e299
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 hash:
8d4805f0651186046c48d3e2356623db
SHA1 hash:
18c27c000384418abcf9c88a72f3d55d83beda91
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
MD5 hash:
ead020db018b03e63a64ebff14c77909
SHA1 hash:
89bb59ae2b3b8ec56416440642076ae7b977080e
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
MD5 hash:
b8d249a5e394b4e6a954c557af1b80e6
SHA1 hash:
b03bb9d09447114a018110bfb91d56ef8d5ec3bb
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
MD5 hash:
c540308d4a8e6289c40753fdd3e1c960
SHA1 hash:
1b84170212ca51970f794c967465ca7e84000d0e
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
MD5 hash:
307ef797fc1af567101afba8f6ce6a8c
SHA1 hash:
0023f520f874a0c3eb3dc1fe8df73e71bde5f228
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
MD5 hash:
e1adac219ec78b7b2ac9999d8c2e1c94
SHA1 hash:
6910ec9351bee5c355587e42bbb2d75a65ffc0cf
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
MD5 hash:
2c5aca898ff88eb2c9028bbeefebbd1e
SHA1 hash:
7a0048674ef614bebe6cc83b1228d670372076c9
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
MD5 hash:
5eac41b641e813f2a887c25e7c87a02e
SHA1 hash:
ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
MD5 hash:
df538704b8cd0b40096f009fd5d1b767
SHA1 hash:
d2399fbb69d237d43624e987445694ec7e0b8615
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
MD5 hash:
245498839af5a75cd034190fe805d478
SHA1 hash:
d164c38fd9690b8649afaef7c048f4aabb51dba8
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
MD5 hash:
3a26cd3f92436747d2285dcef1fae67f
SHA1 hash:
e3d1403be06beb32fc8dc7e8a58c31e18b586a70
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
SH256 hash:
ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
MD5 hash:
7d40a697ca6f21a8f09468b9fce565ad
SHA1 hash:
dc3b7f7fc0d9056af370e06f1451a65e77ff07f7
Link:
https://www.unpac.me/results/87841129-1bf4-4a02-af28-0d5dc84a57f9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2fc6f2fd32d630c1202fed63c8a1b32b7046f89162ffc568c0f802ac6441354d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/22859/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::ConvertSidToStringSidW
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetTokenInformation
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleWindow
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::FindFirstFileW
KERNEL32.dll::RemoveDirectoryW
KERNEL32.dll::SetDllDirectoryW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments