🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DesktopStreamRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f
SHA3-384 hash: 01d17838ae8830dbd71c47d27a1df99281ea9bfc67313582b7cfac960b4700819281e867b22a3e49cdbfc513b342125d
SHA1 hash: bcb2faabe3b54565754b22b6ba9a42466258b7e1
MD5 hash: a5002456926fc6dcf3e0ea735ccb68f9
humanhash: fifteen-sad-fillet-music
File name:43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f.bin
Download: download sample
Signature DesktopStreamRAT
Create hunting rule
File size:894'464 bytes
First seen:2026-11-10 12:08:46 UTC
Last seen:2026-11-10 12:49:21 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 7be476d096ff2d43b2380de66c82171e (2 x DesktopStreamRAT)
ssdeep 12288:PzbANGIcymiSuf17H2FSTxEEPrJQ7os7kCcsHHP6epZWoVHCDOAy2mQXuIeuakBe:LfjyH2FQPrYzIy6mQPOUmQeLvB4E
TLSH T17115CF06929901BCE0B7A3789D575902FB7A780903B1DAEF03D4D5772E56AE09E3EF10
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter kernelv0id
Tags:DesktopStreamRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
170
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-10 17:21:05 UTC
Tags:
lold rat
Link:
https://app.any.run/tasks/425116bd-f4f8-424f-8a6e-6aa53cb3e5d6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99150/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af30973463538821bc39eee
Tags:
crypted dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating synchronization primitives
Connection attempt
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug cmd crypto hacktool installer-heuristic lolbin masquerade microsoft_visual_cc overlay packed reconnaissance stealer
Link:
https://www.filescan.io/uploads/6af3096bd3a2fe92d60c1fa4/reports/d94021de-e7b6-4592-b416-1450606a9bd4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-31T20:54:00Z UTC
Last seen:
2026-11-01T13:29:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/c45c9db1-d196-4df7-b77b-ccdaee5d94bf
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/2003196
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
86%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/a5002456926fc6dcf3e0ea735ccb68f9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f/
Threat name:
Win64.Trojan.Passwordstealer
Create hunting rule
Status:
Malicious
First seen:
2026-10-31 18:35:22 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ipl6yi7tlh7u2ospiqajssfn6m4n54mqqunaaxao2w2lyjpo2fpq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261110-pbkvqssyhw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Malware Family:
n/a
Verdict:
Suspicious
Tags:
rat
YARA:
WMI_strings ParentProcessEvasion win_token UNPROTECT_disable_process AutorunKey CreateScheduledTask
Link:
https://app.threat.zone/submission/5d45cbbd-52ef-4369-8e59-a1d91609f2cf
Malware Family:
stealer
Create hunting rule
Malicious:
True
Tags:
exe 64bit polymorphic file-overlay obfuscated exec-delay
Link:
https://intel.virussign.com/intelligence/file/43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f
Unpacked files
SH256 hash:
43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f
MD5 hash:
a5002456926fc6dcf3e0ea735ccb68f9
SHA1 hash:
bcb2faabe3b54565754b22b6ba9a42466258b7e1
Link:
https://www.unpac.me/results/d13eb37e-d88e-482e-9d55-33870cf796de/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/43d7ec23f359ff4d3a4f44009948adf338def190851a005c0ed5b4bc25eed15f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Lold_Loader_Implant_CFG_V1
Create hunting rule
Author:Daydream
Description:Lold/1.0 (Lold.UpdateClient) x64 C++ loader/implant and verbatim outer PE wrappers: matches the .loldcfg (LOLD_CFG_V1) configuration section, Lold/1.0 User-Agent, Local\Lold_ mutex, --lold-container CLI flag, and rs42 Reed-Solomon RS(4,2) chunk assembly strings
Reference:https://bazaar.abuse.ch/sample/269b268ad54168172f307ae50896b64735e3164946f4abc91c2e8257b0fb6300/
Rule name:MAL_Win_LoldUpdateClient
Create hunting rule
Author:anonymous
Description:Lold Update Client (lold-container) payload delivered via ClickFix: WinHTTP C2 on :8093 (/files, /files/hb, /files/inbox), embedded LOLD_CFG_V1 config
Rule name:MAL_Win_LoldUpdateClient_Config
Create hunting rule
Author:anonymous
Description:Lold Update Client embedded config block (LOLD_CFG_V1 + C2 URL + k_ key); also matches memory dumps
Rule name:MAL_Win_Lold_Memory_C2
Create hunting rule
Author:anonymous
Description:Lold Update Client C2 artefacts in process memory or dumps: :8093 base URL with payload chunk path or k_ session key
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TigerRAT_pe_yaraify
Create hunting rule
Author:hunts-yara-code
Description:YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/99150/

Comments