MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58559368fafe00bd435188bd5b89c8568503568805ac7ceddccb37f7bc2db636. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	58559368fafe00bd435188bd5b89c8568503568805ac7ceddccb37f7bc2db636
SHA3-384 hash:	b25d702943a02a0d2ab216800e2fd6dc09535899e85f1b7c01d194023fcc08598ae847f3cedf3aeb26dfe3e6196091d4
SHA1 hash:	794b3f9a77bd862655829d650246c062231427f2
MD5 hash:	edbfff34af2c478e4e519f0867123917
humanhash:	freddie-johnny-hydrogen-single
File name:	Watch2Gether_x64.exe
Download:	download sample
File size:	93'319'168 bytes
First seen:	2026-09-23 20:27:00 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	359e649ab913e838011b9d61180c7f7f (2 x LucidStealer, 1 x MicroStealer)
ssdeep	786432:rvu1zt09Qu4fx5386W+Vv6e6dG/uAJDJ22IJIIrTl0:ju1C9L4fTLv6FiJDJ22IJIIrTu
TLSH	T104187D13B3E70595E8F7DA3196E65123A932BC066F3085DF324C07262F73AE05A7AB51
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	f89efcf8f971f2e0 (10 x NodeLoader, 9 x FixStealer, 6 x Amadey)
Reporter	nextpro
Tags:	exe stealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

1'025

Origin country :

US

Vendor Threat Intelligence

ACCE BLX_Downloader MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9cc15aee-84d0-42fa-bda4-d0f6e6c323b9/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Watch2Gether_x64.exe

Verdict:

Malicious activity

Analysis date:

2026-09-23 20:21:33 UTC

Tags:

python generic stealer ims-api arch-exec arch-doc evasion openssl tool

Link:

https://app.any.run/tasks/33ab568d-c115-4474-9ed7-1b64c53e2ddf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Creating a file in the %temp% directory

Creating a file

Deleting a recently created file

Creating a process from a recently created file

Creating a process with a hidden window

Running batch commands

Moving a recently created file

Creating a window

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm crypto fingerprint microsoft_visual_cc reconnaissance

Link:

https://www.filescan.io/uploads/6ab4362f9fb209884b6a4f5c/reports/46b0774c-5712-4f19-8029-14ee7bcc7835/overview

Hybrid Analysis TrojanSpy/Stealer.x

Verdict:

Malicious

Labled as:

TrojanSpy/Stealer.x

Link:

https://www.hybrid-analysis.com/sample/58559368fafe00bd435188bd5b89c8568503568805ac7ceddccb37f7bc2db636

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-23T18:51:00Z UTC

Last seen:

2026-09-23T20:04:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/58559368fafe00bd435188bd5b89c8568503568805ac7ceddccb37f7bc2db636/results?tab=lookup

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/58559368fafe00bd435188bd5b89c8568503568805ac7ceddccb37f7bc2db636

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Infostealer.Generic

Threat name:

Win64.Infostealer.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-23 20:28:38 UTC

File Type:

PE+ (Exe)

Extracted files:

13

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lbkzg2h27yal2q2rrc6vxcoik2cqgvuiawwhz3o4zm37ppbnwy3a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan

Link:

https://tria.ge/reports/260923-y8kexawerh/

Behaviour

Modifies registry class

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

Event Triggered Execution: Netsh Helper DLL

Executes a command shell one-liner

Discovers running processes

Drops file in System32 directory

Command and Scripting Interpreter: PowerShell

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.