MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63cedb109aa1eb02c5c947f0988fe6f582f35ab7060ac8ba1d55fbd4aef36be1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AmateraStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	63cedb109aa1eb02c5c947f0988fe6f582f35ab7060ac8ba1d55fbd4aef36be1
SHA3-384 hash:	764073681e73f4ce0ada43371567bc7e7bdd557ed9581c492d7004fb33999f0a07f0efff1071273be903a3e5ffa2fe52
SHA1 hash:	3d3a582a98432a4e4c7cb9514bcc95b4d8f4eb59
MD5 hash:	cc17896aa31cd557642ef0874a6cd7db
humanhash:	purple-salami-twelve-pizza
File name:	SecuriteInfo.com.Win32.MalwareX-gen.78148259
Download:	download sample
Signature	AmateraStealer Create hunting rule
File size:	5'631'416 bytes
First seen:	2026-02-23 21:24:16 UTC
Last seen:	2026-02-23 22:22:48 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	c903b07a4fe92b7685b4f37b81527eb5 (2 x AmateraStealer)
ssdeep	98304:LBZW6bD/D6t0XeUpGbeCqQPOB/LQaQwVvLzxeN7t4QazX3mWBNGl:LZE0OUECCqQo/rdLzxKgmU0
Threatray	1 similar samples on MalwareBazaar
TLSH	T1AD4612A5264D3616CC4B307F8A6C7F5C92EEE96C47049F9B8628CCF71A1335BA878507
TrID	34.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 13.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 13.7% (.EXE) Win64 Executable (generic) (6522/11/2) 10.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	AmateraStealer dll

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/54341/

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699cc5c9c950ab5d9ab0fe66

Tags:

injection obfusc

Result

Verdict:

Clean

Maliciousness:

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/63cedb109aa1eb02c5c947f0988fe6f582f35ab7060ac8ba1d55fbd4aef36be1

Result

Gathering data

Malware family:

AresLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d9cee058-c4be-4e78-a672-ba29353e4d86

Score:

45%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/63cedb109aa1eb02c5c947f0988fe6f582f35ab7060ac8ba1d55fbd4aef36be1

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/63cedb109aa1eb02c5c947f0988fe6f582f35ab7060ac8ba1d55fbd4aef36be1/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mphnwee2uhvqfroji7yjrd7g6wbpgwvxayfmroq5kx55jlxtnpqq._file

Verdict:

malicious

Label(s):

amaterastealer

Similar samples:

error

AmateraStealer

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/260223-z9sy4sb16e/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Unpacked files

SH256 hash:

63cedb109aa1eb02c5c947f0988fe6f582f35ab7060ac8ba1d55fbd4aef36be1

MD5 hash:

cc17896aa31cd557642ef0874a6cd7db

SHA1 hash:

3d3a582a98432a4e4c7cb9514bcc95b4d8f4eb59

Link:

https://www.unpac.me/results/ca0f792b-8af7-4a9b-b1c1-f1470c8912d7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.32

Link:

https://yomi.yoroi.company/submissions/63cedb109aa1eb02c5c947f0988fe6f582f35ab7060ac8ba1d55fbd4aef36be1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.