MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MaskGramStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098
SHA3-384 hash: bda62addb70696fbdb8bafbd4ce268f93976393dbaafa4b55717582ab635a06b7fb2f3aab7ee22446cdc78bee66797fb
SHA1 hash: 0b75b81bf7498bb54fca61a6385be82adf3ace36
MD5 hash: 449391a04e9f7aee985783decaafdc15
humanhash: delaware-spring-florida-sweet
File name:file
Download: download sample
Signature MaskGramStealer
Create hunting rule
File size:124'928 bytes
First seen:2026-01-08 14:52:40 UTC
Last seen:2026-01-08 16:19:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b48b4dde0f2f8c05521ed25ad452dd8f (1 x MaskGramStealer)
ssdeep 3072:aoXmXKkkNHfnuI2s+1YnwjZw++LIHI3q5H73zdIu:aoXmXK3xV2s+1GwjZ/33H73
TLSH T1B3C32BA3D99180F8D42AC17889DBE33E69B3B4811679754E5DE0AF021EB2770F319F49
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543 MaskGramStealer


Avatar
Bitsight
url: http://130.12.180.43/files/7149348537/G2sUM7l.exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
116
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
Svit
Details
Link:
https://research.acce.ciphertechsolutions.com/results/93f83295-1a05-4ef5-ac5e-5b7f5f5461c8/
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2026-01-08 14:54:44 UTC
Tags:
telegram stealer
Link:
https://app.any.run/tasks/b05f4b43-3b71-4e3c-85b2-bf6553819dd8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/48185/
Detection(s):
SecuriteInfo.com.Win64.Evo-gen.68124139.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=695fc4eb9922425f92fedd9a
Tags:
agentb mint
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Behavior that indicates a threat
Query of malicious DNS domain
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug fingerprint mingw packed
Link:
https://www.filescan.io/uploads/695fc4e5aff85b903a46465e/reports/7d789fdd-adae-49be-90e9-2b71d97ebb2c/overview
Verdict:
Malicious
Labled as:
Mint.Zard.Generic
Link:
https://www.hybrid-analysis.com/sample/30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-01-08T12:06:00Z UTC
Last seen:
2026-01-10T12:48:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Vidar.HTTP.C&C PDM:Trojan.Win32.Generic HEUR:Trojan.Win32.Agentb.gen
Link:
https://opentip.kaspersky.com/30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9b5d1865-4bb8-4196-a13b-ea220331326d
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098/
Verdict:
Malicious
Threat:
Family.MASKGRAMSTEALER
Link:
https://tip.neiki.dev/file/30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098
Threat name:
Win64.Trojan.MintZard
Create hunting rule
Status:
Malicious
First seen:
2026-01-08 14:53:28 UTC
File Type:
PE+ (Exe)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gcrisahw27dm2kecvwakksbwr2atdpzail6p4jpkf7zoafw6kcma._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/260108-sccgjatkbx/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
System Time Discovery
Drops file in Windows directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads WinSCP keys stored on the system
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/64b8e2a3-c954-4296-a67c-97d92a7742ae
Unpacked files
SH256 hash:
30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098
MD5 hash:
449391a04e9f7aee985783decaafdc15
SHA1 hash:
0b75b81bf7498bb54fca61a6385be82adf3ace36
Link:
https://www.unpac.me/results/d62a653c-543e-4846-ad49-d9505189e729/
Malware family:
MaskGramStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/30a28900f6d7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Debugger
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MaskGramStealer

Executable exe 30a28900f6d7c6cd2882ad80a548368e8131bf2042fcfe25ea2ff2e016de5098

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3753450/
Cape
Cape
https://www.capesandbox.com/analysis/48185/

Comments