MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 24 File information Comments

SHA256 hash:	4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04
SHA3-384 hash:	b05979b64875e11614829299f32c2311bce8a139d496ebe3d0f3e9ab45d1b21c5c5bcb0dfbfccb9c40745153c89f67df
SHA1 hash:	6bddc63d22cd0260b63155bae60e2e4b047211cf
MD5 hash:	9c9a207c8d0a7561ef2926cf2b36a6bd
humanhash:	arizona-sink-bulldog-butter
File name:	SecuriteInfo.com.Trojan.PWS.Stealer.44129.31416.23705
Download:	download sample
File size:	13'720'576 bytes
First seen:	2026-02-08 10:30:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d42595b695fc008ef2c56aabd8efd68e (155 x Vidar, 92 x Rhadamanthys, 74 x Stealc)
ssdeep	98304:Nu8jGpHMZMMZxbSPG8YXo4bwZ7+oPAsv3n1XKaym:Nu8jG6JPSPGFXzYbIG7ym
TLSH	T1D6D638C3F4E21CA4C4E9C3B591368266EA357C4D0B3663EB9790BA342F323E16576B51
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 d4ad4681863eca87acffda22218a845e9813b9b550240a2a0c5b76c56a3f778e

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	5'042'176 bytes
File size (de-compressed) :	13'720'576 bytes
Format:	win64/pe
Packed file:	d4ad4681863eca87acffda22218a845e9813b9b550240a2a0c5b76c56a3f778e

Intelligence

File Origin

# of uploads :

# of downloads :

107

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04.exe

Verdict:

Malicious activity

Analysis date:

2025-12-15 06:45:42 UTC

Tags:

arch-doc golang

Link:

https://app.any.run/tasks/c0053ed1-f9ad-4c1c-807c-f2c3af538aa3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/52654/

Detection(s):

Win.Tool.Garble-10044180-0

Win.Trojan.Sliver-10044264-0

PUA.Win.Packer.Embedpe-3

PUA.Win.Packer.AcprotectUltraprotect-1

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=693fae99039c1dfc73395c0e

Tags:

vmdetect

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm anti-vm crypto golang obfuscated

Link:

https://www.filescan.io/uploads/698865f1981ff1d38a4d0773/reports/106a7981-c4a1-46df-a68a-298f943d1456/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04

Result

Gathering data

Verdict:

Adware

File Type:

exe x64

First seen:

2025-12-13T10:23:00Z UTC

Last seen:

2025-12-13T23:36:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/97d8c191-57c4-4d56-bc65-6303017b8e92

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1865523

Signature

Bypasses PowerShell execution policy

Deletes itself after installation

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/9c9a207c8d0a7561ef2926cf2b36a6bd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04/

Verdict:

Malicious

Threat:

NetTool.PlainTextCredentials.HTTP

Link:

https://tip.neiki.dev/file/4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jlob34y6ak35wugm2z55j3mxla5h3smmnv6dwm3a4juqkfbizmca._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260208-mkghkahz6b/

Behaviour

GoLang User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Deletes itself

Command and Scripting Interpreter: PowerShell

Unpacked files

SH256 hash:

4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04

MD5 hash:

9c9a207c8d0a7561ef2926cf2b36a6bd

SHA1 hash:

6bddc63d22cd0260b63155bae60e2e4b047211cf

Link:

https://www.unpac.me/results/9b4baed2-f426-4d38-8d64-a4f5dc9e6db1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.98

Link:

https://yomi.yoroi.company/submissions/4adc1df31e02b7db50ccd67bd4ed97583a7dc98c6d7c3b3360e269051428cb04

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	dependsonpythonailib Create hunting rule
Author:	Tim Brown
Description:	Hunts for dependencies on Python AI libraries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)