MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69957c3038fcb6a2cc6ce66813f3e58dcd55fbe3bea739da3ff089502b721e4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 17 File information Comments

SHA256 hash:	69957c3038fcb6a2cc6ce66813f3e58dcd55fbe3bea739da3ff089502b721e4c
SHA3-384 hash:	490665a9db4a335763f697b5651805acad9d46b04decf172f9527857fee4c06cdb193373eb1c8e5289675203a01e53dd
SHA1 hash:	6692e8e523d8792a3638aa774a6f2097a6ff8d5c
MD5 hash:	4c120e0fbe3af3f810a6ccf03a801fd1
humanhash:	hydrogen-oranges-lion-butter
File name:	iclickfix_implant_unpacked.bin
Download:	download sample
File size:	401'408 bytes
First seen:	2026-10-04 08:59:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
ssdeep	6144:ehJb46Mq9/ZQg5CaPgHMC7cwREuFAeVWlQ/ppzIQ:ehK6v5ZQg5CdYiEuFom
TLSH	T12A841816E79390ACDEF3D67095A6DE72AA71BC741421AC2B43D08A332F63B40753DB16
TrID	28.6% (.EXE) DOS Executable Borland Pascal 7.0x (2035/25) 28.2% (.EXE) Generic Win/DOS Executable (2002/3) 28.2% (.EXE) DOS Executable (generic) (2000/1) 14.1% (.SCORE) Music Craft Score (1007/6) 0.4% (.VXD) VXD Driver (29/21)
Magika	pebin
Reporter	MaciekG
Tags:	ClickFix EtherHiding exe hvnc iclickfix unpacked

MaciekG

#IClickFix #ClickFix #EtherHiding #infostealer #HVNC. DISCLAIMER - FIXED/UNPACKED DUMP, read before relying on this hash: the first 4096 bytes (PE header) are a SYNTHETIC header WE built (DOS+NT_HEADERS64+9 sections, ImageBase 0x3a50000) from the memory page permission map, NOT original malware bytes - the implant zeroes its own real PE header at runtime as an anti-dump technique, so the captured header was all zeros. Everything from file offset 0x1000 onward is bit-identical to what was captured live from the memory of an infected explorer.exe process (verified, nothing else changed). Because the header is unique to our reconstruction, this hash will not match any previously known sample - that is expected for a fixed dump, not an attempt to present this as the original packed file. Companion/unpacked counterpart to the packed shellcode already submitted as 9dd7356282e11693b917283f6abd9a2229e164c39effc152d3b927e1d674931a (iclickfix_shellcode.bin) and reloader DLL 47f00527433abe430995b6e1a601d8712030d51d51997f914e309a6166a9c231 (modernexecserver.dll). Capabilities confirmed by decompilation (Ghidra + manual capstone/IAT resolution of 331 WinAPI calls, MinGW GCC, undocumented family, lab PDB-less, provisionally called 'Slaiclind' - zero OSINT/VT/MalwareBazaar hits on that name): hidden-desktop HVNC (SetThreadDesktop/OpenInputDesktop/BlockInput), browser credential/cookie theft incl. DPAPI (CryptUnprotectData) and ABE bypass via DLL injection, 100+ crypto wallet/extension scanner + BIP39 seed phrase search, WH_KEYBOARD_LL keylogger, clipboard monitor window class 'ClpMon', GDI+ screenshots, process hollowing into a second process, anti-analysis process-list + idle-time checks. C2 195.63.139[.]180:443 (raw TCP, no TLS, uint32 LE length + ciphertext, 30 s heartbeat). Persists via HKCU COM hijack of CLSID {EF7F04A5-461B-4E32-840D-5841AB00713C} and re-downloads itself from <server>/hvnc/bin via a second Polygon contract (0xb2A4EA7055b7E2A6B2d96502f0ff85024e72987b) if the mutex Global\{7A3B9C1E-4D5F-8E2A-B6C0-1F3E5D7A9B2C} is absent. Observed in a lab detonation 2026-10-04.

Intelligence

File Origin

# of uploads :

# of downloads :

204

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-04 09:03:00 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0d33a9bd-71af-493a-8c6f-630ccc7f0cb5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/90596/

Detection(s):

MiscreantPunch.SingleXOR.EXE.172.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching a service

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm cmd evasive expand exploit explorer finger hacktool lolbin masquerade obfuscated overlay packed rundll32 squirrel xor-pe xor-pe

Link:

https://www.filescan.io/uploads/6ac215b6963bd7a1075c5bda/reports/17e2b5e9-6677-4884-adce-15f501374125/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/69957c3038fcb6a2cc6ce66813f3e58dcd55fbe3bea739da3ff089502b721e4c

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-04T07:14:00Z UTC

Last seen:

2026-10-05T21:28:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/69957c3038fcb6a2cc6ce66813f3e58dcd55fbe3bea739da3ff089502b721e4c/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/720ec1ee-cd92-4416-b532-2ccd2aaf3442

Score:

79%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/69957c3038fcb6a2cc6ce66813f3e58dcd55fbe3bea739da3ff089502b721e4c

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/4c120e0fbe3af3f810a6ccf03a801fd1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/69957c3038fcb6a2cc6ce66813f3e58dcd55fbe3bea739da3ff089502b721e4c/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ngkxymby7s3kftdm4zubh47frxgvl67dx2tttwr76cevak3sdzga._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261004-kyh77szwet/

Unpacked files

SH256 hash:

69957c3038fcb6a2cc6ce66813f3e58dcd55fbe3bea739da3ff089502b721e4c

MD5 hash:

4c120e0fbe3af3f810a6ccf03a801fd1

SHA1 hash:

6692e8e523d8792a3638aa774a6f2097a6ff8d5c

Detections:

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

SUSP_XORed_MSDOS_Stub_Message

Link:

https://www.unpac.me/results/966a6047-8fac-4f0f-a070-787a43575b69/

SH256 hash:

47f00527433abe430995b6e1a601d8712030d51d51997f914e309a6166a9c231

MD5 hash:

6555f9b3120192f04e29b93373475165

SHA1 hash:

e49c51558a1c8b3506922938680a6f3604402c8e

Link:

https://www.unpac.me/results/966a6047-8fac-4f0f-a070-787a43575b69/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.86

Link:

https://yomi.yoroi.company/submissions/69957c3038fcb6a2cc6ce66813f3e58dcd55fbe3bea739da3ff089502b721e4c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CMD_Ping_Localhost Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	dependsonpythonailib Create hunting rule
Author:	Tim Brown
Description:	Hunts for dependencies on Python AI libraries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Surtr Create hunting rule
Author:	Katie Kleemola
Description:	Rule for Surtr Stage One

Rule name:	SurtrStrings Create hunting rule
Author:	Katie Kleemola
Description:	Strings for Surtr

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	TeslaCryptPackedMalware Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Malware_Unknown_ForgeAuto_37b4704b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 69957c3038fcb6a2cc6ce66813f3e58dcd55fbe3bea739da3ff089502b721e4c

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/90596/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample