MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cfe4697bd8bc1509ac9ce6db874c2f0c2dba396167f92e89953bf2c71ba002d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cfe4697bd8bc1509ac9ce6db874c2f0c2dba396167f92e89953bf2c71ba002d
SHA3-384 hash: 2f0d1faf7bd1a3e9e04bb0e5d67406274702a6d208dd26c06157bf7288b466d61c363bac8e587aa76221be94037322bf
SHA1 hash: bf93fdd033e13cfcc64e7a165210ea239997dff3
MD5 hash: 148c0d6f40d8c3bab6429761dd04fdd2
humanhash: two-autumn-enemy-salami
File name:file
Download: download sample
File size:1'057'792 bytes
First seen:2026-07-22 00:04:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a4f5d0326b7d22eae00281de1ea0104e
ssdeep 24576:8PvkwoKUW+JireQ5diwzkbY6c8zHj+VLW:2vkQKwOcBW
TLSH T10825F112B15546FCE0A7C0B4C2454AE2AA3178960F72BEFF079112262F7ABE15F3CB55
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter Bitsight
Tags:54e64e dropped-by-amadey exe


Avatar
Bitsight
url: http://91.92.242.236/files-129312398/files/file_6038528412370730.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75598/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a60092c85479d70bfb79b2a
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm cmd lolbin packed rust
Link:
https://www.filescan.io/uploads/6a60092489419e40a50bb807/reports/aff78988-89be-4093-b2ff-42d3664571b2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/6cfe4697bd8bc1509ac9ce6db874c2f0c2dba396167f92e89953bf2c71ba002d
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e45c8f7d-84ce-4bcd-bf37-c9e20234fb01
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6cfe4697bd8bc1509ac9ce6db874c2f0c2dba396167f92e89953bf2c71ba002d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cfe4697bd8bc1509ac9ce6db874c2f0c2dba396167f92e89953bf2c71ba002d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nt7enf55rpavbgwjzzw3q5gc6dbnxi4wcz7zf2ezko7sy4n2aawq._file
Verdict:
malicious
Label(s):
WallStealer
Create hunting rule
Link:
https://reports.threatray.com/544b968c-fe50-4576-b8b9-7d35f423e176
Similar samples:
015a389e5c97ec1e545978359e19c08050ce2b3d23c88557ec9f4a540a4c6c51
184d0b251392babb683b1b7e48ed5a64714655504244f00a02d9cc7c7d483ce1
5bcc88a01ec83f5fb45d0c329e6e16e8b6e74ffbb9b59d739507244604f16b53
65900750c4bcf44855e5ebf9548aaaa29f9a6abd5141769f617b35fd096bb95e
6673c0852fbf8372d4bc146806b2ea1b1e23bc807b792338204e227098789bae
97c5aed61b4b0a2d143311922cd07ac720e452781a98ed03a9e7002e315e2b8d
Result
Malware family:
wall_stealer
Create hunting rule
Score:
  10/10
Tags:
family:wall_stealer stealer
Link:
https://tria.ge/reports/260722-ac3dvagf27/
Behaviour
Suspicious use of WriteProcessMemory
Detects WallStealer stealer
Family: WallStealer
Unpacked files
SH256 hash:
6cfe4697bd8bc1509ac9ce6db874c2f0c2dba396167f92e89953bf2c71ba002d
MD5 hash:
148c0d6f40d8c3bab6429761dd04fdd2
SHA1 hash:
bf93fdd033e13cfcc64e7a165210ea239997dff3
Link:
https://www.unpac.me/results/fd4fec26-166b-4c8a-911c-264b6e328ca9/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6cfe4697bd8bc1509ac9ce6db874c2f0c2dba396167f92e89953bf2c71ba002d

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75598/
  
URLhaus
https://urlhaus.abuse.ch/url/3889910/

Comments