MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a194fa1bf6a0bbf7b9f164b5a81d6d4f8258c5aec5943db0b35977849950ad2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RevStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	3a194fa1bf6a0bbf7b9f164b5a81d6d4f8258c5aec5943db0b35977849950ad2
SHA3-384 hash:	93a71556834e41265c8da08e164dfc508bb6213d840c70da7d4e28144fdf44d3e2125a5a34d7866b74f5e26f0f5fe0de
SHA1 hash:	14f92afa36fb720357d1ce252559bb82bee5e643
MD5 hash:	7f723b0c3564c6c452474b2ec939c8dc
humanhash:	paris-hydrogen-chicken-stream
File name:	3a194fa1bf6a0bbf7b9f164b5a81d6d4f8258c5aec5943db0b35977849950ad2.exe
Download:	download sample
Signature	RevStealer Create hunting rule
File size:	2'991'616 bytes
First seen:	2026-09-07 00:38:46 UTC
Last seen:	2026-10-19 07:58:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	5a2ed47d8c6c6433dbc831d38c92042b (50 x RevStealer)
ssdeep	49152:6AmH548yUi1Tt3V42Soh2wEdWtgYZnv8zUOC2vLV4a0/X52w1+v77S:6r548yUUTt3baWtTv8zfJ54H/F1YS
TLSH	T10DD523D8BED21571E033C3B756C354BEB16A7B4186604D8BB6C96B007E22A2DAC37375
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Tuxxin
Tags:	exe RevStealer whack.sh

Intelligence

File Origin

# of uploads :

# of downloads :

182

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d2602604-6bc2-4e4a-9446-720a17fe446d/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/84290/

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.66225947.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac72a7d9acbb098cc29bb00

Tags:

malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Searching for synchronization primitives

Setting an event handler

DNS request

Moving of the original file

Setting a global event handler for the keyboard

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a9e07b02917a9e93d2be2c1/reports/c17a8e43-60f7-4085-a9ec-73f1eef62071/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/3a194fa1bf6a0bbf7b9f164b5a81d6d4f8258c5aec5943db0b35977849950ad2

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-06T23:03:00Z UTC

Last seen:

2026-09-08T07:30:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/3a194fa1bf6a0bbf7b9f164b5a81d6d4f8258c5aec5943db0b35977849950ad2/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/93547301-6ec0-45d5-83c7-f97690c0fcdc

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1969930

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (exiting after language check)

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Queries DNS domain through GetComputerNameExW (potential sandbox evasion)

Suricata IDS alerts for network traffic

Tries to steal Crypto Currency Wallets

Uses schtasks.exe or at.exe to add and modify task schedules

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3a194fa1bf6a0bbf7b9f164b5a81d6d4f8258c5aec5943db0b35977849950ad2

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/7f723b0c3564c6c452474b2ec939c8dc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3a194fa1bf6a0bbf7b9f164b5a81d6d4f8258c5aec5943db0b35977849950ad2/

Threat name:

Win64.Trojan.Tedy

Status:

Malicious

First seen:

2026-09-07 00:39:19 UTC

File Type:

PE+ (Exe)

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=himu7in7nif36647czfvvaow2t4cldc25rmuhwylgwlxqsmvblja._file

Result

Malware family:

n/a

Score:

7/10

Tags:

execution persistence spyware stealer

Link:

https://tria.ge/reports/260907-az15asvhrg/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: RenamesItself

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Accesses cryptocurrency files/wallets, possible credential harvesting

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

3a194fa1bf6a0bbf7b9f164b5a81d6d4f8258c5aec5943db0b35977849950ad2

MD5 hash:

7f723b0c3564c6c452474b2ec939c8dc

SHA1 hash:

14f92afa36fb720357d1ce252559bb82bee5e643

Link:

https://www.unpac.me/results/34416b60-874f-4bfd-8b8d-fe1c8693638e/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3a194fa1bf6a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3a194fa1bf6a0bbf7b9f164b5a81d6d4f8258c5aec5943db0b35977849950ad2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/