MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnappyClient


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc
SHA3-384 hash: 0985c6d53fadfd65dfae667f74fe99b9553faf36b988352f45a9682d507d0c74eee0613ae5f0d4d5491da2b519f1ad13
SHA1 hash: 27b203af98ba343e993cd56fe07155c3e33af4cb
MD5 hash: bf884691b6fcfcc4ee0f80b782d7e9ff
humanhash: triple-stairway-hotel-papa
File name:3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc
Download: download sample
Signature SnappyClient
Create hunting rule
File size:7'826'714 bytes
First seen:2026-04-14 14:57:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d7e2fd259780271687ffca462b9e69b7 (6 x AsyncRAT, 6 x LummaStealer, 6 x AurotunStealer)
ssdeep 196608:8fUhLtyAwqlnUQ0YemmcwXnRAK108fm5NaMtS7F+7TB0QFOEwCdohSp2jGx:MwtyAwi0Y/FInaB8+5NPS7FwaGMjRi
Threatray 3 similar samples on MalwareBazaar
TLSH T12076233291555133F6F505B7AD2862303EACA338276048A9E6E4DD0D7EE88967BF3347
TrID 22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win64 Executable (generic) (6522/11/2)
17.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.7% (.EXE) Win32 Executable (generic) (4504/4/1)
7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon b2e1b496a6cada72 (13 x LummaStealer, 13 x AsyncRAT, 11 x HijackLoader)
Reporter JAMESWT_WT
Tags:exe SnappyClient xx-kak-is

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
russo.exe
Verdict:
Malicious activity
Analysis date:
2026-02-24 00:03:26 UTC
Tags:
hijackloader loader stealer amsi-bypass
Link:
https://app.any.run/tasks/c1618b5a-98ae-4c52-83f8-9ef2d3142436

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61570/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69de562545787c53e539a5ca
Tags:
injection dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Creating a file in the %temp% directory
Creating a window
Сreating synchronization primitives
Creating a file
Creating a file in the %AppData% subdirectories
Using the Windows Management Instrumentation requests
DNS request
Connecting to a non-recommended domain
Connection attempt
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm anti-vm base64 cmd crypto expand expired-cert expired-cert explorer fingerprint fingerprint infostealer installer installer installer-heuristic keylogger lolbin lolbin microsoft_visual_cc packed rugmi runonce short-lived-cert wix wix
Link:
https://www.filescan.io/uploads/69de561ed920e19044fb7d2f/reports/b38b46df-fe1c-444b-8ab7-23f93af11986/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-23T20:18:00Z UTC
Last seen:
2026-04-15T10:45:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Zenpak.sb Trojan-Spy.Win32.KeyLogger.sba Trojan-Dropper.Win32.Injector.sb Trojan-Dropper.Win32.Dapato.sb Trojan.Win32.Penguish.gps Trojan.Win32.Strab.sb Trojan.Win32.Penguish.sb Trojan.Win32.Inject.sb Trojan.Win32.Penguish.gpt
Link:
https://opentip.kaspersky.com/3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/4c1c4888-e37c-4142-8798-bba958bf1102
Score:
84%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc/
Verdict:
Malicious
Threat:
Family.HIJACKLOADER
Link:
https://tip.neiki.dev/file/3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc
Threat name:
Win32.Trojan.Hijackloader
Create hunting rule
Status:
Malicious
First seen:
2026-02-24 03:30:27 UTC
File Type:
PE (Exe)
Extracted files:
116
AV detection:
18 of 36 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h24nvxjuakjmin4fmaha4abwg7tcdvxfulkzgt52jzkzbs3f7dga._file
Verdict:
malicious
Label(s):
hijackloader
Create hunting rule
Similar samples:
4ceec9e93a1021697e5e23ac3e67cf886dadf683e3ddc40f7a2c770115027cbd
SnappyClient
c8251d1aba99075ce6f8f735b72015c2589e936bcdf544f87c5947324ec8b056
SnappyClient
d8f11fe16666255b4be2a16416de176217c51f9fe8a063ec19df6691ff82a0fc
SnappyClient
error
SnappyClient
Result
Malware family:
snappyclient
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader family:snappyclient backdoor discovery loader stealer
Link:
https://tria.ge/reports/260414-scgfgsdz9j/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Family: SnappyClient
Unpacked files
SH256 hash:
e6b48226ddd50e9c5caacc6d0e5c4c56ab5069f0bb86f8d412b2055681a108b2
MD5 hash:
d83afad5f091a43ea3776ca7cd36f624
SHA1 hash:
ec10e5da796c81a65731376736da2ec5e7488090
Link:
https://www.unpac.me/results/ab790618-c187-437f-9aba-19d5e863d83a/
SH256 hash:
a8bd90b059cb1d4d16d7ab318cab8fcb6dea8a94bcfda652af0df0fe66969be0
MD5 hash:
8ea1618c38c036ca7009b8e996692894
SHA1 hash:
81774bb3cd6e00d3f944dd9cf75c6d1fcda11372
Link:
https://www.unpac.me/results/ab790618-c187-437f-9aba-19d5e863d83a/
SH256 hash:
c1b872b34a871773a7992cca4bbf2599e5a43b469e7af35a07cc4dd7a28e031c
MD5 hash:
cc00e1781d6f476fe5ebf0cfab3b3a22
SHA1 hash:
d20284b4cb83cfc351aeafcae97df7adf99789fe
Detections:
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Link:
https://www.unpac.me/results/ab790618-c187-437f-9aba-19d5e863d83a/
SH256 hash:
3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc
MD5 hash:
bf884691b6fcfcc4ee0f80b782d7e9ff
SHA1 hash:
27b203af98ba343e993cd56fe07155c3e33af4cb
Link:
https://www.unpac.me/results/ab790618-c187-437f-9aba-19d5e863d83a/
Malware family:
GHOSTPULSE
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3eb8dadd3402/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/61570/

Comments