MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3187d3e3b16a56070801701cb040843b67ee52f3a601be142267fd0ea0d91e3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

VenomRAT

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments

SHA256 hash:	3187d3e3b16a56070801701cb040843b67ee52f3a601be142267fd0ea0d91e3b
SHA3-384 hash:	6176300a2f75b4b2d8e1c448b58a1718779e529d157d77187ad2721e07ffc143e0b35e174e49c6ec9562e96754bb772c
SHA1 hash:	3ec72a056a414fbfff63c49e2b4700d0c85d4b75
MD5 hash:	1350b10189d061d630ab614be7935351
humanhash:	aspen-colorado-charlie-vegan
File name:	imagetxt0074751.png
Download:	download sample
Signature	VenomRAT Create hunting rule
File size:	643'584 bytes
First seen:	2026-03-25 16:13:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'853 x AgentTesla, 19'780 x Formbook, 12'304 x SnakeKeylogger)
ssdeep	12288:Yu327BfcYqMzHr54K4N3hr3ZOWgB5jDIoE:McRMze5hr3ZIjjDN
TLSH	T113D49D7676A28E22D2895733C1CB440083E4D786B5A7F74E758413AB19073BFDE47AA3
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe PNG RAT VenomRAT

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NETReactor

Details

NETReactor

decrypted strings

Link:

https://research.acce.ciphertechsolutions.com/results/da034e8f-bda9-4ecc-9334-45a45fab6e9a/

Malware family:

n/a

ID:

File name:

Purchase_Order_ECG_20260325-001.js

Verdict:

Malicious activity

Analysis date:

2026-03-25 07:09:50 UTC

Tags:

susp-powershell stealer loader

Link:

https://app.any.run/tasks/aa43c0f9-d1e6-4b8f-814f-23c6bbb6f8a7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.46186869.UNOFFICIAL

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c409acaacb4c376b13f664

Tags:

underscore extens

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 crypt masquerade net_reactor obfuscated obfuscated packed packed xpack

Link:

https://www.filescan.io/uploads/69c409a500ad363694059fbc/reports/43914ca9-d8cb-403c-86a0-4ea5e6bf52b5/overview

Verdict:

Malicious

Labled as:

MSIL.Benin.Generic

Link:

https://www.hybrid-analysis.com/sample/3187d3e3b16a56070801701cb040843b67ee52f3a601be142267fd0ea0d91e3b

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-03-25T03:29:00Z UTC

Last seen:

2026-03-26T08:34:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/3187d3e3b16a56070801701cb040843b67ee52f3a601be142267fd0ea0d91e3b/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/4845bdc2-6f03-432f-8863-99a42ef40c86

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1889046

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Creates a thread in another existing process (thread injection)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Writes to foreign memory regions

Yara detected MSIL Injector

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3187d3e3b16a56070801701cb040843b67ee52f3a601be142267fd0ea0d91e3b

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3187d3e3b16a56070801701cb040843b67ee52f3a601be142267fd0ea0d91e3b/

Threat name:

ByteCode-MSIL.Trojan.Benin

Status:

Malicious

First seen:

2026-03-25 09:07:36 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ggd5hy5rnjlaocaboaolaqeehnt64uxtuya34fbcm76q5igzdy5q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

collection discovery spyware stealer

Link:

https://tria.ge/reports/260325-tn93lsfv7t/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

3187d3e3b16a56070801701cb040843b67ee52f3a601be142267fd0ea0d91e3b

MD5 hash:

1350b10189d061d630ab614be7935351

SHA1 hash:

3ec72a056a414fbfff63c49e2b4700d0c85d4b75

Link:

https://www.unpac.me/results/7f8fcf5b-e0ca-460a-8e6c-a4739565de26/

SH256 hash:

d79dd7e931b39e379ce8269c91521c3f10635131c505a4c414209ae28b1b7064

MD5 hash:

57bc8c3d59539a6b831eafc55e008084

SHA1 hash:

8702fc1bfe6002f2f5c4d0a819043bfbba444cc7

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/7f8fcf5b-e0ca-460a-8e6c-a4739565de26/

Malware family:

PureRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3187d3e3b16a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3187d3e3b16a56070801701cb040843b67ee52f3a601be142267fd0ea0d91e3b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.