🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ResolverRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632
SHA3-384 hash: 38245a439e708cdbc6715851123faba4f938dbb5958ed5b39d6254c9992f16628881283e619371263e6b1bafaff72760
SHA1 hash: f431fcfa23f1d35a038afc577d043226b6039ef9
MD5 hash: 504369337d62d78887c7ca59e96b865c
humanhash: rugby-earth-pennsylvania-neptune
File name:504369337d62d78887c7ca59e96b865c.exe
Download: download sample
Signature ResolverRAT
Create hunting rule
File size:2'678'272 bytes
First seen:2026-05-18 11:11:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c6fb30ad4dce883317a7260ffcbc1a17 (1 x Chisel, 1 x QuasarRAT, 1 x ResolverRAT)
ssdeep 49152:O10qUjV1rWlhVbTbROsfTPQ6bkCcvgxHImfVS:O10RV5gRHfk6gCFomfVS
Threatray 6 similar samples on MalwareBazaar
TLSH T1D9C57C10FE9754F2E806153189A762AF23358D491F32CBD7EA487A7DF9B7AE10836305
TrID 41.0% (.EXE) InstallShield setup (43053/19/16)
29.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter abuse_ch
Tags:exe ResolverRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
MicrosoftEdge.exe
Verdict:
Malicious activity
Analysis date:
2026-05-14 20:27:31 UTC
Tags:
golang stealer rat
Link:
https://app.any.run/tasks/dfbd4fa7-0847-45f0-bd13-e90649524e87

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/66277/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0af3ee3f97dd5ad5ac2927
Tags:
obfuscate xtreme virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Launching a service
Сreating synchronization primitives
Launching a process
Using the Windows Management Instrumentation requests
Connecting to a non-recommended domain
Connection attempt
Sending a custom TCP request
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm crypto evasive go golang packed
Link:
https://www.filescan.io/uploads/6a0af3e2efbd399b39b6f0a6/reports/5b7ae11f-5201-4683-8cb1-e1ad6dadb144/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-14T19:43:00Z UTC
Last seen:
2026-05-20T08:43:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Win32.Coins.sb PDM:Trojan.Win32.Generic HEUR:Trojan-PSW.MSIL.Stealer.gen Trojan.Win32.Shellcode.pmq Trojan.Win32.Shellcode.sb Trojan.MSIL.Dnoper.sb Backdoor.MSIL.Agent.sb Trojan.Win64.Agentb.sb Trojan-PSW.Win32.Stealer.sb
Link:
https://opentip.kaspersky.com/2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7f189e15-b550-4b90-bff8-edc67781d8e1
Result
Threat name:
PureCrypter, DonutLoader, ResolverRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1914927
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Detected PureCrypter Trojan
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Suricata IDS alerts for network traffic
Tries to harvest and steal Bitcoin Wallet information
Unusual module load detection (module proxying)
Yara detected DonutLoader
Yara detected MSIL Injector
Yara detected ResolverRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1914927 Sample: fHfCUnThHA.exe Startdate: 18/05/2026 Architecture: WINDOWS Score: 100 29 Suricata IDS alerts for network traffic 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Antivirus detection for dropped file 2->33 35 8 other signatures 2->35 7 fHfCUnThHA.exe 1 29 2->7         started        12 GoogleUpdate.exe 2->12         started        14 GoogleUpdate.exe 22 2->14         started        16 2 other processes 2->16 process3 dnsIp4 27 178.236.252.52, 49693, 56001 PRANET-ASRU Russian Federation 7->27 23 C:\Users\user\AppData\...behaviorgraphoogleUpdate.exe, PE32 7->23 dropped 25 C:\Users\user\AppData\...\cmake_14.5.0.exe, PE32 7->25 dropped 39 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 7->39 41 Found many strings related to Crypto-Wallets (likely being stolen) 7->41 43 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 7->43 53 5 other signatures 7->53 18 powershell.exe 37 7->18         started        45 Antivirus detection for dropped file 12->45 47 Multi AV Scanner detection for dropped file 12->47 49 Unusual module load detection (module proxying) 12->49 51 Detected PureCrypter Trojan 14->51 file5 signatures6 process7 signatures8 37 Loading BitLocker PowerShell Module 18->37 21 conhost.exe 18->21         started        process9
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632/
Verdict:
Malicious
Threat:
Trojan.Win32.Shellcode
Link:
https://tip.neiki.dev/file/2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632
Threat name:
Win32.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-05-14 23:02:55 UTC
File Type:
PE (Exe)
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f7ztzo2v3k3n76lurbzeunpyy6iwguut55litlpeokeu5qnmsyza._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
Similar samples:
2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632
ResolverRAT
6195c2773a6b83f55aa9328638a601fb10a61c63c0b618e159c0f35082b11ecb
ResolverRAT
6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2
ResolverRAT
9dfbd4ad0dde7ed7833f3120992f7c40b60aa48ab27041a600ace20e0c316aaf
ResolverRAT
d7e987c4a9d74af9ccdc5405cecdea301b0a764e1a5cae1dbf4a4f76104edd14
ResolverRAT
error
ResolverRAT
Gathering data
Unpacked files
SH256 hash:
2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632
MD5 hash:
504369337d62d78887c7ca59e96b865c
SHA1 hash:
f431fcfa23f1d35a038afc577d043226b6039ef9
Link:
https://www.unpac.me/results/39248804-1ab0-4998-a7ef-89b722beab71/
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2ff33cbb55da/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ff33cbb55dab6dff97488724a35f8c791635293ef5689ade472894ec1ac9632

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/66277/

Comments