🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ResolverRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94
SHA3-384 hash: 005ba5d427d14f0f65b18e4fa4db7d78a785cc87cef96f6438d493340b7e225c4c5b67ee4469635ca5e87fc1801a00a0
SHA1 hash: 57630f125fbbce40c5f41bb20dd71279f35b57d0
MD5 hash: 13c2866712f360a35b887c67f4757372
humanhash: hot-music-uranus-georgia
File name:MANGO's Global Project, including Salary and Benefits for Successful Candidates.lnk
Download: download sample
Signature ResolverRAT
Create hunting rule
File size:1'351 bytes
First seen:2026-05-22 17:08:57 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/x-ms-shortcut
ssdeep 24:8lJ0f6kbLaoCMbUK6qWGakTY4eLDT+AMpaBdIjsm:8Qffa434iYNfT+tSIjs
TLSH T1E821FE4C8ECE8B16D1F2073EA8BA3203DA247A1DDD12CFEE00D4C2065852611D839F3B
Magika lnk
Reporter smica83
Tags:lnk ResolverRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
LNK
Details
LNK
a command line and any observed urls
Link:
https://research.acce.ciphertechsolutions.com/results/04b186da-54ba-4baa-a3f8-d989be74cef9/
Detection(s):
MiscreantPunch.INFO.LNK.CMDPSHELL.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27118.LnkHeur.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.LNK.Obfus-2.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a108dd733e785de369cd77f
Tags:
ransomware vmdetect shell sage
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94/results/dashboard
Payload URLs
URL
File name
https://r4w.8it7u9userc0ntent.c0m/tiiisiet65-sud0/L0i0i0N04isK/m4in/D0wnl04d-m4cOSx.cmd
LNK File
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd csc lolbin powershell
Link:
https://www.filescan.io/uploads/6a108dccefbd399b39c7653e/reports/fd6eadfa-370a-41f3-bcb8-baef8fe6ca9e/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94
Verdict:
Malicious
File Type:
lnk
First seen:
2026-05-22T14:57:00Z UTC
Last seen:
2026-05-24T01:44:00Z UTC
Hits:
~10
Detections:
Trojan.WinLNK.Agent.sb HEUR:Trojan.WinLNK.Powecod.d HEUR:Trojan.Multi.Powedon.a
Link:
https://opentip.kaspersky.com/49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94/results?tab=lookup
Result
Threat name:
DonutLoader, ResolverRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1917791
Signature
Bypasses PowerShell execution policy
Drops VBS files to the startup folder
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Found pyInstaller with non standard icon
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Drops script at startup location
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal Bitcoin Wallet information
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows shortcut file (LNK) starts blacklisted processes
Yara detected DonutLoader
Yara detected MSIL Injector
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1917791 Sample: MANGO's Global Project, inc... Startdate: 22/05/2026 Architecture: WINDOWS Score: 100 97 loeop.com 2->97 99 raw.githubusercontent.com 2->99 101 bg.microsoft.map.fastly.net 2->101 111 Suricata IDS alerts for network traffic 2->111 113 Malicious sample detected (through community Yara rule) 2->113 115 Windows shortcut file (LNK) starts blacklisted processes 2->115 117 10 other signatures 2->117 13 cmd.exe 1 2->13         started        16 wscript.exe 2->16         started        18 wscript.exe 2->18         started        20 wscript.exe 2->20         started        signatures3 process4 signatures5 133 Windows shortcut file (LNK) starts blacklisted processes 13->133 135 Suspicious powershell command line found 13->135 22 powershell.exe 14 16 13->22         started        26 conhost.exe 1 13->26         started        137 Windows Scripting host queries suspicious COM object (likely to drop second stage) 16->137 process6 dnsIp7 103 raw.githubusercontent.com 185.199.111.133, 443, 49692, 49697 FASTLY-FastlyIncUS United States 22->103 121 Windows shortcut file (LNK) starts blacklisted processes 22->121 123 Found many strings related to Crypto-Wallets (likely being stolen) 22->123 28 cmd.exe 1 22->28         started        signatures8 process9 process10 30 sys_installer_23893.exe 14 82 28->30         started        33 csc.exe 4 28->33         started        file11 87 C:\Users\user\AppData\Local\...\python.exe, PE32 30->87 dropped 89 C:\Users\user\AppData\Local\Temp\...\run.py, Python 30->89 dropped 91 C:\Users\user\AppData\Local\...\winsound.pyd, PE32 30->91 dropped 95 56 other files (none is malicious) 30->95 dropped 35 python.exe 3 41 30->35         started        93 C:\Users\user\...\sys_installer_23893.exe, PE32 33->93 dropped 39 cvtres.exe 1 33->39         started        process12 file13 71 C:\Users\user\AppData\Local\Temp\...\py.exe, PE32 35->71 dropped 73 C:\Users\user\AppData\Local\...\winsound.pyd, PE32 35->73 dropped 75 C:\Users\user\AppData\...\vcruntime140.dll, PE32 35->75 dropped 77 26 other files (none is malicious) 35->77 dropped 119 Found pyInstaller with non standard icon 35->119 41 py.exe 1 8 35->41         started        46 Acrobat.exe 55 35->46         started        48 conhost.exe 35->48         started        signatures14 process15 dnsIp16 105 loeop.com 51.79.253.174, 49703, 56001 OVHFR Singapore 41->105 79 C:\Users\user\AppData\Roaming\...\run.vbs, ASCII 41->79 dropped 81 C:\Users\user\AppData\...\tmpddpokqqz.xml, XML 41->81 dropped 83 C:\Users\user\AppData\Local\Temp\...\run.vbs, ASCII 41->83 dropped 85 C:\Users\user\AppData\Roaming\drivers.exe, PE32 41->85 dropped 125 Windows shortcut file (LNK) starts blacklisted processes 41->125 127 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 41->127 129 Found many strings related to Crypto-Wallets (likely being stolen) 41->129 131 9 other signatures 41->131 50 cmd.exe 41->50         started        53 powershell.exe 41->53         started        55 AcroCEF.exe 46->55         started        57 AcroCEF.exe 46->57         started        59 AcroCEF.exe 46->59         started        file17 signatures18 process19 signatures20 107 Uses schtasks.exe or at.exe to add and modify task schedules 50->107 61 conhost.exe 50->61         started        63 schtasks.exe 50->63         started        109 Loading BitLocker PowerShell Module 53->109 65 conhost.exe 53->65         started        67 WmiPrvSE.exe 53->67         started        69 AcroCEF.exe 55->69         started        process21
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/49a27468cf5e8eb607c7ed4a605936fee1b345230080d18d5f24cd8295dbbd94
Threat name:
Shortcut.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-05-22 17:09:40 UTC
File Type:
Binary
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jgrhi2gpl2hlmb6h5vfgawjw73q3grjdacanddk7etgyffo3xwka._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
adware discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260522-vpdlgabs9p/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Contacts third-party web service commonly abused for C2
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
https://raw.githubusercontent.com/tiiisiet65-sudo/LoioioNoaisK/main/Download-macOSx.cmd
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/49a27468cf5e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:LNK_sospechosos
Create hunting rule
Author:Germán Fernández
Description:Detecta archivos .lnk sospechosos
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_CMD
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to cmd.exe inside an lnk file, which is suspicious
Rule name:SUSP_LNK_PowerShell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to powershell inside an lnk file, which is suspicious
Rule name:SUSP_LNK_SuspiciousCommands
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects LNK file with suspicious content

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments