MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Intelligence 12 IOCs YARA 11 File information Comments

SHA256 hash:	679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc
SHA3-384 hash:	309317f409bd7bec620c28cfe5f584acedca0deed6e899dfcc5cb7fac072ae7294dce6b72253f78274207ca148e952f4
SHA1 hash:	318d6c6c34aa03892fbc415dca6998721c901492
MD5 hash:	16a1634c426f77ccbbd65d29c08d0b2c
humanhash:	fillet-paris-lake-network
File name:	file
Download:	download sample
File size:	8'028'203 bytes
First seen:	2026-03-25 16:52:31 UTC
Last seen:	2026-03-25 20:30:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	be2085eec435a1549df9720eb686778c (3 x RustyStealer)
ssdeep	196608:ggwXmkmBnBibeI9+a+ds7hOjgG8Mk355WLgBB:/umrTI9D+d8hsgG/kp
TLSH	T11886E05A490277FDEFFED2B94129F1EB882071835612B285A7014BB8BD79D5CDE3812C
TrID	50.0% (.EXE) Generic Win/DOS Executable (2002/3) 49.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543

Bitsight

url: http://158.94.208.168/files/7281753217/CE1auOG.exe

Intelligence

File Origin

# of uploads :

# of downloads :

157

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

_679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc.exe

Verdict:

Malicious activity

Analysis date:

2026-03-25 16:55:28 UTC

Tags:

auto-startup auto-sch evasion rust anti-evasion discord stealer

Link:

https://app.any.run/tasks/1b984c54-087f-4d6f-a1a0-0910849a68ae

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c41309aacb4c376b13f852

Tags:

autorun xtreme shell sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Launching a process

DNS request

Creating a file in the %temp% directory

Creating a process from a recently created file

Searching for synchronization primitives

Launching the process to interact with network services

Connection attempt

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm base64 cmd evasive expand lolbin microsoft_visual_cc overlay packed soft-404

Link:

https://www.filescan.io/uploads/69c41301e2df9aa488b78a23/reports/0dc09148-75c1-4b04-ad25-d6c71403465b/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc

Verdict:

Malicious

File Type:

exe x64

Detections:

Trojan-Dropper.Win32.Agent.sb Trojan.Win64.Agent.gen Trojan.Win32.Agent.xcdemt Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/ea4e6590-6005-4940-a746-58dc3437807c

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-03-25 16:53:27 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m6npgdvlpmqljooa7e2qlvojadpymfspkczxr3vuxxmypq5qohga._file

Result

Malware family:

n/a

Score:

8/10

Tags:

credential_access defense_evasion discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/260325-vd492sg17s/

Behaviour

Detects videocard installed

Enumerates system info in registry

Gathers network information

Modifies data under HKEY_USERS

Modifies registry class

Runs net.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Enumerates physical storage devices

System Time Discovery

Drops file in Windows directory

Hide Artifacts: Ignore Process Interrupts

Accesses cryptocurrency files/wallets, possible credential harvesting

Command and Scripting Interpreter: PowerShell

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Obfuscated Files or Information: Command Obfuscation

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Uses browser remote debugging

Unpacked files

SH256 hash:

679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc

MD5 hash:

16a1634c426f77ccbbd65d29c08d0b2c

SHA1 hash:

318d6c6c34aa03892fbc415dca6998721c901492

Link:

https://www.unpac.me/results/1dab9842-8ec4-48f7-b244-fe0b65b5f28d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/679af30eab7b20b4b9c0f93505d5c900df86164f50b378eeb4bdd987c3b071cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Rust Create hunting rule
Author:	albertzsigovits
Description:	Application written in Rust programming language

Rule name:	Rustyloader_mem_loose Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/