🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 447e7d5ed5e5bae4d4d34057f2ad9a580583bf363c18befd6c28abec57c0490b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SeroRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 33 File information Comments 2
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 447e7d5ed5e5bae4d4d34057f2ad9a580583bf363c18befd6c28abec57c0490b
SHA3-384 hash: d25ed78804e928863db32a740a6fa9eb7f1bdf5ab35fbdcf9369d4afd110995bb97f276816384b8c8d10f48c400572d0
SHA1 hash: 213ab74d392e00fc5de6d51d8ad87e7b05a718a1
MD5 hash: 25a7c4a7d8ca13429745d57f052401f7
humanhash: lemon-mississippi-item-summer
File name:25a7c4a7d8ca13429745d57f052401f7.exe
Download: download sample
Signature SeroRAT
Create hunting rule
File size:10'791'424 bytes
First seen:2026-10-10 13:15:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash e1d7a2a4dd86a155658900fb65355bc0 (1 x SeroRAT)
ssdeep 98304:PMx77F2Tew1LTlv5SHAfVfWc1b41HAqYN3B9QY:PMxHF2Tew1XlxscVfVRqYNxO
TLSH T1A7B66C1AE3B049E3DB2ACA38CB56CA32D771BC611615930B18D5F20E2F336E09F5E565
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe SeroRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
234
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-10 13:29:29 UTC
Tags:
uac ip-check auto-reg generic stealer
Link:
https://app.any.run/tasks/349ef14b-ff7f-4e91-9747-e417ecfbb751

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91365/
Detection(s):
SecuriteInfo.com.Trojan.Siggen34.60992.11347.23111.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad0aefc6f551121ba15f30b
Tags:
stration dropper emotet remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Creating a service
Launching a service
Loading a system driver
BSOD occurred
Enabling autorun for a service
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto evasive fingerprint masquerade microsoft_visual_cc overlay reconnaissance
Link:
https://www.filescan.io/uploads/6aca3a7826eaa009068c8793/reports/0ae2b9c9-1bb1-40a3-97fc-f9583b697f81/overview
Verdict:
Malicious
Labled as:
TrojanSpy/Stealer.cr
Link:
https://www.hybrid-analysis.com/sample/447e7d5ed5e5bae4d4d34057f2ad9a580583bf363c18befd6c28abec57c0490b
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-06T18:43:00Z UTC
Last seen:
2026-10-11T17:45:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/447e7d5ed5e5bae4d4d34057f2ad9a580583bf363c18befd6c28abec57c0490b/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6cf6edd8-8768-48a3-92a4-e42e23636707
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1985308
Signature
Adds a directory exclusion to Windows Defender
Adds extensions / path to Windows Defender exclusion list (Registry)
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Yara detected PersistenceViaHiddenTask
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1985308 Sample: wtPrvhgsKr.exe Startdate: 10/10/2026 Architecture: WINDOWS Score: 100 70 api.ipify.org 2->70 78 Malicious sample detected (through community Yara rule) 2->78 80 Multi AV Scanner detection for dropped file 2->80 82 Multi AV Scanner detection for submitted file 2->82 84 4 other signatures 2->84 9 wtPrvhgsKr.exe 1 7 2->9         started        14 windows.exe 2->14         started        16 windows.exe 2->16         started        18 9 other processes 2->18 signatures3 process4 dnsIp5 72 216.86.70.40, 2727, 49713 LCPUD-LewisCountyPUDUS United States 9->72 74 api.ipify.org 172.67.74.152, 443, 49715 CLOUDFLARENET-CloudflareIncUS Canada 9->74 76 127.0.0.1 unknown unknown 9->76 62 C:\Users\user\AppData\Roaming\...\windows.exe, PE32+ 9->62 dropped 64 C:\Users\user\AppData\...\astc38b221c.sys, PE32+ 9->64 dropped 66 C:\Users\user\AppData\Local\...\svchost.dat, PE32+ 9->66 dropped 68 C:\Users\user\...\windows.exe:Zone.Identifier, ASCII 9->68 dropped 94 Suspicious powershell command line found 9->94 96 Found many strings related to Crypto-Wallets (likely being stolen) 9->96 98 Adds a directory exclusion to Windows Defender 9->98 100 Sample is not signed and drops a device driver 9->100 20 windows.exe 9->20         started        24 powershell.exe 23 9->24         started        26 powershell.exe 9->26         started        36 30 other processes 9->36 28 powershell.exe 14->28         started        30 powershell.exe 16->30         started        102 Adds extensions / path to Windows Defender exclusion list (Registry) 18->102 32 powershell.exe 18->32         started        34 MpCmdRun.exe 18->34         started        file6 signatures7 process8 file9 60 C:\Users\user\AppData\...\jusflye3.x40.xml, XML 20->60 dropped 86 Multi AV Scanner detection for dropped file 20->86 88 Suspicious powershell command line found 20->88 90 Uses schtasks.exe or at.exe to add and modify task schedules 20->90 92 Adds a directory exclusion to Windows Defender 20->92 38 schtasks.exe 20->38         started        40 schtasks.exe 20->40         started        42 conhost.exe 24->42         started        44 conhost.exe 26->44         started        46 conhost.exe 28->46         started        48 conhost.exe 30->48         started        50 conhost.exe 32->50         started        52 conhost.exe 34->52         started        54 29 other processes 36->54 signatures10 process11 process12 56 conhost.exe 38->56         started        58 conhost.exe 40->58         started       
Score:
76%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/447e7d5ed5e5bae4d4d34057f2ad9a580583bf363c18befd6c28abec57c0490b
Verdict:
inconclusive
YARA:
7 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/25a7c4a7d8ca13429745d57f052401f7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/447e7d5ed5e5bae4d4d34057f2ad9a580583bf363c18befd6c28abec57c0490b/
Threat name:
Win64.Trojan.Atorea
Create hunting rule
Status:
Malicious
First seen:
2026-10-06 23:35:39 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ir7h2xwv4w5ojvgtibl7flm2lacyhpzwhqml57lmfcv6yv6ajefq._file
Verdict:
malicious
Label(s):
SeroRAT
Create hunting rule
Link:
https://reports.threatray.com/8e4a3d6f-8a01-48fe-9a07-ed6008f2bb9b
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution persistence spyware stealer trojan
Link:
https://tria.ge/reports/261010-qhf1sswy6p/
Behaviour
Checks processor information in registry
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Reads the TCP/IP host and domain name from the registry
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Windows security modification
Command and Scripting Interpreter: PowerShell
Windows security bypass
Unpacked files
SH256 hash:
447e7d5ed5e5bae4d4d34057f2ad9a580583bf363c18befd6c28abec57c0490b
MD5 hash:
25a7c4a7d8ca13429745d57f052401f7
SHA1 hash:
213ab74d392e00fc5de6d51d8ad87e7b05a718a1
Detections:
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/f3199405-0d66-4c56-8b37-7a4c632cde4e/
SH256 hash:
4a8b6b462c4271af4a32cf8705fa64913bfcdaefb6cf02d1e722c611d428cb16
MD5 hash:
748b2514db1438fe16a2ddb56bfcf011
SHA1 hash:
5e5223ade55520d7119d359fbf2dbc4ce51e9d8a
Link:
https://www.unpac.me/results/f3199405-0d66-4c56-8b37-7a4c632cde4e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/447e7d5ed5e5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:detect_Redline_Stealer_V2
Create hunting rule
Author:Varp0s
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

SeroRAT

Executable exe 447e7d5ed5e5bae4d4d34057f2ad9a580583bf363c18befd6c28abec57c0490b

(this sample)

SeroRAT

Executable exe d0f2273f828b10391adcf877ff0775924e4b63435ec240b1047d89a1fa95a229

Cape
Cape
https://www.capesandbox.com/analysis/91365/
  
Dropping
SHA256 d0f2273f828b10391adcf877ff0775924e4b63435ec240b1047d89a1fa95a229
  
Dropping
MD5 79145aeb30802f73692b4aed57ea50f3

Comments


Avatar
commented on 2026-10-11 18:43:24 UTC

Behaviour observed in an isolated lab (Windows 10 Pro, no real internet). Elevated start: adds Defender exclusions via powershell Add-MpPreference -ExclusionPath; drops %TEMP%\ast<8 hex>.sys (Astra64.sys) and loads it as kernel service AstraDrv, deleting the service about a second later; copies itself to %APPDATA%\Windows\windows.exe and to %LOCALAPPDATA%\Microsoft\WindowsServices\svchost.dat (byte-identical copies); a copy then runs as SYSTEM with winlogon.exe as parent; persistence = scheduled task 'Windows' (schtasks /Create /XML ... /TN "Windows", runs windows.exe --vx89ab-task as SYSTEM) plus Run value 'Windows' in HKCU and HKLM; retries 216.86.70.40:2727 after about 20, 30, 50, 90 s. Started unelevated with UAC on: runs schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I (UAC bypass attempt), writes %TEMP%\vx89ab_elev_Windows.txt, and did not contact the C2 in 240 s. Build marker string: vx89ab.

Avatar
commented on 2026-10-11 04:40:20 UTC

SeroRAT client, .NET NativeAOT (assembly SeroStub, posing as RuntimeBroker). C2 216.86.70.40:2727, raw TLS 1.2 without SNI; server certificate CN=SeroServer, O=Sero, OU=Loader, SHA-256 4ED31A72025B5272092C5C99F247FFF6E99FE5120E707031AEAE5292A16C5063, which the client pins. Config strings are XORed with an SFC64 keystream (32-byte key, state = four LE uint64); host list decrypts to 127.0.0.1 and 216.86.70.40, port is an immediate. 3-second heartbeat, 4-byte length prefix per message. Embeds Astra64.sys (4a8b6b462c4271af4a32cf8705fa64913bfcdaefb6cf02d1e722c611d428cb16) for BYOVD and an App-Bound Encryption helper DLL (d0f2273f828b10391adcf877ff0775924e4b63435ec240b1047d89a1fa95a229). AMSI/ETW API names XORed with 0xF3+i.