MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SantaStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9
SHA3-384 hash: cd1b8cec191caf389631cfefffd9c2aea301ba6f6bb2f4adfa61e07e9e3054b90c552eef832cfa3cf63ce4918886f45e
SHA1 hash: e14953240f2b8f471ee2d79d31f535bfaae85183
MD5 hash: 9e875377e349fd351a221764e0647036
humanhash: item-potato-april-kentucky
File name:file
Download: download sample
Signature SantaStealer
Create hunting rule
File size:4'511'232 bytes
First seen:2026-04-14 23:39:29 UTC
Last seen:2026-04-15 05:10:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ed6edba9ec77ed904b0920d79686675c (3 x SantaStealer)
ssdeep 98304:HJ69mv0newp3EX0wEvj9Hg3bPvW/ZYXuFNxMUB:HUc+waJHg37AZKMN9B
Threatray 105 similar samples on MalwareBazaar
TLSH T1C0269C27E3A360ECC53BD0749747E672B931B8490434BE6A0A84C7613F66E605B7EB74
TrID 45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
18.0% (.EXE) Win64 Executable (generic) (6522/11/2)
13.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.ICL) Windows Icons Library (generic) (2059/9)
5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:D dropped-by-gcleaner EU.file exe SantaStealer


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
6
# of downloads :
194
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
teamviewer
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2026-04-14 23:41:58 UTC
Tags:
auto-reg stealer tightvnc rmm-tool teamviewer santastealer vidar
Link:
https://app.any.run/tasks/56d68541-5140-441c-a571-2dbab3fceec4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61617/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ded041f68adfe10039e509
Tags:
clipbanker infosteal emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching a process
Creating a file in the %AppData% subdirectories
Creating a process with a hidden window
Loading a suspicious library
Creating a window
Reading critical registry keys
Sending a custom TCP request
Changing a file
DNS request
Connection attempt
Sending an HTTP GET request
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 crypto expand fingerprint hacktool infostealer lolbin overlay packed rundll32 zusy
Link:
https://www.filescan.io/uploads/69ded038d920e19044fbfb3c/reports/d2e7b3b3-499e-4508-9cd9-57b94be73684/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-04-14T20:58:00Z UTC
Last seen:
2026-04-16T11:46:00Z UTC
Hits:
~100
Detections:
Trojan-Spy.Win32.Stealer.sb Trojan-PSW.Win32.Lumma.acqq PDM:Trojan.Win32.Generic Backdoor.Win32.Androm.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.Win32.Vidar.sb Trojan-Banker.Win32.ClipBanker.aidf Trojan-PSW.Win32.Lumma.sb Trojan-Spy.Win32.SpyEyes Trojan-Spy.Stealer.HTTP.C&C Trojan-PSW.Win32.Greedy.sb VHO:Trojan-Banker.Win32.ClipBanker.aidf Trojan-PSW.Win32.Stealer.sb Trojan-Banker.Win32.ClipBanker.sb Trojan.Win32.Inject.sb Trojan-PSW.Stealer.HTTP.C&C Trojan-Dropper.Win32.Injector.sb Trojan.Win32.DLLhijack.sb
Link:
https://opentip.kaspersky.com/5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3edc0f45-12c4-4713-be51-3a4b6d0a3e70
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9/
Verdict:
Malicious
Threat:
Family.TIGHTVNC
Link:
https://tip.neiki.dev/file/5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9
Threat name:
Win64.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-04-14 23:40:50 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k4ecq7aooztxzwqgjzzcds5addxsyf7eyvkwzs7yfhg7uvtcdo4q._file
Verdict:
malicious
Label(s):
santastealer
Create hunting rule
Similar samples:
2f3d8bf8174044b548617536c952f5c8ed96896fc7252ae8fd260279cca8471f
SantaStealer
393c38626cfc87137e608d53a9d5334d86b9ee941bd90bb17ec7083ba19b1a21
SantaStealer
419310523f9ed7393e7fee0204c7f5ecccf3082ce0c7c16e03bd7ba235bcb62e
SantaStealer
526ab999fb00cdd92ce229eb945274b15c26acfca62c40d2f5cc6aa259a979d1
SantaStealer
67f41be88bdff63e8320865979b0e0f4f6031422b40bbe2944924feb173d6945
SantaStealer
7b261029fc9d8915a8061ba064fae14c54c7b863c6c5259020d954fa90b5a1e0
SantaStealer
825403678f778a98132341bfbac1c3c0da1ec2cc1ea1d637a253c2511c008022
SantaStealer
9ff847266eccbe55815df693cf3f91a87b8a1691b1b059333ca4b36c8157d47b
SantaStealer
a494a1d8d6df5ddf5d0fce26414c4e722ad985a2089afa34cd28a0de01e73f92
SantaStealer
adc7f6df608b7579c4b020361258ed3349ff6de031f707afaea2945ccdaaaa9e
SantaStealer
error
SantaStealer
+ 95 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
credential_access discovery persistence spyware stealer
Link:
https://tria.ge/reports/260414-3nlvfsfw8z/
Behaviour
Checks processor information in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Browser Information Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Credentials from Password Stores: Windows Credential Manager
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9
MD5 hash:
9e875377e349fd351a221764e0647036
SHA1 hash:
e14953240f2b8f471ee2d79d31f535bfaae85183
Link:
https://www.unpac.me/results/75b646b7-3942-4381-870f-49b868d880d2/
SH256 hash:
a183afa16910fd6c643e4767934028623f5a0fa058643dfb4f5bd59d160d6687
MD5 hash:
5dd87292bea62c66cd9f4d2474da1c11
SHA1 hash:
13f121b08c3a3d87755b2289b3c5eea67076b824
Link:
https://www.unpac.me/results/75b646b7-3942-4381-870f-49b868d880d2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5708287c0e76/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SantaStealer

Executable exe 5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/61617/

Comments