🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GhostPulse


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e
SHA3-384 hash: ab67295292791a2f8abb7b269d35d4f78017f7ddc32d9b166af67cd8b90360ccb7761b53494240696f4f70c5cb0ac492
SHA1 hash: d9b9f80a8688764c8f97c6a57ee0ac307658cecb
MD5 hash: c9554a55f9189eaf082f98385cc4330f
humanhash: california-mountain-magnesium-uncle
File name:kythy.exe
Download: download sample
Signature GhostPulse
Create hunting rule
File size:10'841'677 bytes
First seen:2026-06-05 20:55:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b5a014d7eeb4c2042897567e1288a095 (24 x HijackLoader, 23 x GhostPulse, 14 x ValleyRAT)
ssdeep 196608:+pt9n7OHyp8a1eFOlZiN6mLaCQMGvuezqksFsSjLRLOfF38+nxbX:+pt9n7OSpWFOl4La3E5kcjFc8SxL
Threatray 278 similar samples on MalwareBazaar
TLSH T1F2B6334077942876CD648830AF8F177150BAC32929360E5F8ACE6E156F875E15B8F3EE
TrID 42.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.8% (.EXE) Win64 Executable (generic) (6522/11/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4504/4/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon c292ecd8f2f6fe1c (23 x HijackLoader, 23 x GhostPulse, 12 x Vidar)
Reporter aachum
Tags:65-21-96-128 66-163-113-238 apexdataserver3-lol exe GhostPulse HIjackLoader SnappyClient vidar


Avatar
iamaachum
https://apexdataserver3.lol/load/kythy.exe

Vidar C2: 65.21.96.128
SnappyClient C2: 66.163.113.238:3333

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.exe
Verdict:
No threats detected
Analysis date:
2026-06-05 21:01:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/29729452-12b5-4e0d-89d9-a0ecb94e6103

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
HijackLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69277/
Detection(s):
SecuriteInfo.com.PUA.Win32.CandyOpen.23887.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2337d557b7bf261d614d43
Tags:
shellcode dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a file in the %AppData% subdirectories
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context evasive fingerprint installer installer installer-heuristic microsoft_visual_cc overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6a2337cc4bb6e36d180c5082/reports/6f5105ca-0763-4bd8-b083-170fb3592513/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-05T12:53:00Z UTC
Last seen:
2026-06-07T01:14:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Penguish.hop Trojan.Win32.Strab.sb Trojan.Win32.Penguish.sb Trojan.Win32.Inject.sb
Link:
https://opentip.kaspersky.com/739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/11382d60-549a-45a3-9378-8518b0c20271
Result
Threat name:
HijackLoader, SnappyClient, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1923895
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Detected unpacking (overwrites its own PE header)
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Unusual module load detection (module proxying)
Yara detected HijackLoader
Yara detected SnappyClient
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1923895 Sample: kythy.exe Startdate: 05/06/2026 Architecture: WINDOWS Score: 100 93 yoda.satyamkhabar.com 2->93 95 yoda-vac.online 2->95 97 5 other IPs or domains 2->97 121 Suricata IDS alerts for network traffic 2->121 123 Found malware configuration 2->123 125 Antivirus detection for dropped file 2->125 127 5 other signatures 2->127 13 kythy.exe 8 2->13         started        signatures3 process4 file5 79 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32+ 13->79 dropped 81 C:\Users\user\AppData\Local\...\msvcp_win.dll, PE32+ 13->81 dropped 83 C:\Users\user\AppData\...\Zenith-Syn.exe, PE32+ 13->83 dropped 85 C:\Users\user\AppData\Local\...\SetupXML.dll, PE32+ 13->85 dropped 16 Zenith-Syn.exe 7 13->16         started        process6 file7 55 C:\ProgramData\ctrl_broker\ucrtbase.dll, PE32+ 16->55 dropped 57 C:\ProgramData\ctrl_broker\msvcp_win.dll, PE32+ 16->57 dropped 59 C:\ProgramData\ctrl_broker\Zenith-Syn.exe, PE32+ 16->59 dropped 61 C:\ProgramData\ctrl_broker\SetupXML.dll, PE32+ 16->61 dropped 109 Found hidden mapped module (file has been removed from disk) 16->109 111 Switches to a custom stack to bypass stack traces 16->111 113 Found direct / indirect Syscall (likely to bypass EDR) 16->113 20 Zenith-Syn.exe 14 16->20         started        signatures8 process9 file10 63 C:\Users\user\AppData\...\ucrtbase.dll, PE32+ 20->63 dropped 65 C:\Users\user\AppData\...\msvcp_win.dll, PE32+ 20->65 dropped 67 C:\Users\user\AppData\...\Zenith-Syn.exe, PE32+ 20->67 dropped 69 4 other malicious files 20->69 dropped 133 Modifies the context of a thread in another process (thread injection) 20->133 135 Found hidden mapped module (file has been removed from disk) 20->135 137 Maps a DLL or memory area into another process 20->137 139 2 other signatures 20->139 24 NexusGenera.exe 1 15 20->24         started        29 Zenith-Syn.exe 7 20->29         started        31 Crisp.exe 20->31         started        signatures11 process12 dnsIp13 105 65.21.96.128, 443, 49704, 49705 HETZNER-ASDE Finland 24->105 107 yoda.satyamkhabar.com 172.67.184.6, 443, 49711 CLOUDFLARENET-CloudflareIncUS Canada 24->107 71 C:\Users\user\AppData\Local\...\89b0e7cb.exe, PE32 24->71 dropped 143 Detected unpacking (overwrites its own PE header) 24->143 145 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->145 147 Found many strings related to Crypto-Wallets (likely being stolen) 24->147 157 5 other signatures 24->157 33 cmd.exe 1 24->33         started        73 C:\Users\user\AppData\Roaming\...\Crisp.exe, PE32 29->73 dropped 75 C:\Users\user\AppData\Local\...\296410F.tmp, PE32 29->75 dropped 77 C:\Users\user\AppData\Local\RadiantForg.exe, PE32 29->77 dropped 149 Found hidden mapped module (file has been removed from disk) 29->149 151 Maps a DLL or memory area into another process 29->151 153 Switches to a custom stack to bypass stack traces 29->153 35 RadiantForg.exe 5 29->35         started        39 Crisp.exe 3 29->39         started        155 Unusual module load detection (module proxying) 31->155 file14 signatures15 process16 dnsIp17 41 89b0e7cb.exe 8 33->41         started        44 conhost.exe 33->44         started        99 104.20.23.154, 49730, 80 CLOUDFLARENET-CloudflareIncUS Canada 35->99 101 example.com 172.66.147.243, 49713, 49716, 49721 CLOUDFLARENET-CloudflareIncUS Canada 35->101 103 yoda-line.site 66.163.113.238, 3333, 49712, 49714 AS-GLOBALTELEHOST-GLOBALTELEHOSTCorpCA Canada 35->103 129 Unusual module load detection (module proxying) 35->129 131 Switches to a custom stack to bypass stack traces 35->131 signatures18 process19 signatures20 141 Multi AV Scanner detection for dropped file 41->141 46 Zenith-Syn.exe 7 41->46         started        process21 file22 87 C:\Users\user\AppData\Roaming\...\Crisp.exe, PE32 46->87 dropped 89 C:\Users\user\AppData\...\PortalServe64.exe, PE32+ 46->89 dropped 91 C:\Users\user\AppData\Local\Temp\485BB2.tmp, PE32+ 46->91 dropped 159 Modifies the context of a thread in another process (thread injection) 46->159 161 Maps a DLL or memory area into another process 46->161 50 PortalServe64.exe 9 46->50         started        53 Crisp.exe 46->53         started        signatures23 process24 signatures25 115 Tries to harvest and steal browser information (history, passwords, etc) 50->115 117 Unusual module load detection (module proxying) 50->117 119 Switches to a custom stack to bypass stack traces 53->119
Score:
78%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e/
Verdict:
Malicious
Threat:
Family.GHOSTPULSE
Link:
https://tip.neiki.dev/file/739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e
Threat name:
Win32.Trojan.Hijackloader
Create hunting rule
Status:
Suspicious
First seen:
2026-06-05 20:56:31 UTC
File Type:
PE (Exe)
Extracted files:
86
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ooplvhwmtjxo6dh6wayuzlvqwxu4mobnele6dmaxvllqx3r4laha._file
Verdict:
malicious
Label(s):
tinyutility
Create hunting rule
hijackloader
Create hunting rule
Similar samples:
02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c
GhostPulse
642ecaab44fc4a09fce541bc7c639e77a5f9aa5ef28ca87b595df3c87afb12f8
GhostPulse
65de4ef064eba4afe141fd4226cd7cd96a1eaf9a6f2e47d3d9ed2aa4e257396e
GhostPulse
828405d66881b770753d58349534c978672cda97591e8eb393beca734896539a
GhostPulse
ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a
GhostPulse
b39688635bb5b2a90bb9101b372080b61d6ba78f2cd78ee275a983a84e2a047d
GhostPulse
c88a5bba3b32d6c4cfe3c2d33ea8eb5ada10314a8e049ce02d5cda94abd5aeb8
GhostPulse
+ 268 additional samples on MalwareBazaar
Result
Malware family:
snappyclient
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader family:snappyclient backdoor credential_access discovery loader spyware stealer
Link:
https://tria.ge/reports/260605-zqtfjady5s/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: AddClipboardFormatListener
Modifies registry class
Modifies data under HKEY_USERS
Enumerates system info in registry
Checks processor information in registry
Enumerates physical storage devices
Browser Information Discovery
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops desktop.ini file(s)
Accesses cryptocurrency files/wallets, possible credential harvesting
Unsecured Credentials: Credentials In Files
Reads user/profile data of web browsers
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Family: SnappyClient
Family: HijackLoader, IDAT loader, Ghostulse,
Detects HijackLoader (aka IDAT Loader)
Unpacked files
SH256 hash:
739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e
MD5 hash:
c9554a55f9189eaf082f98385cc4330f
SHA1 hash:
d9b9f80a8688764c8f97c6a57ee0ac307658cecb
Link:
https://www.unpac.me/results/f986958b-b7b4-42e6-a8b5-31671a84345d/
SH256 hash:
9200958d133be7dec69e0dc95925c303d8935b2c5f3a39205ebf535fc01aef19
MD5 hash:
162c8c9dd215a42a59aa83df9d3064d7
SHA1 hash:
e581a5fc5b84aa8c3c90d9f6c26aa00cef240b2d
Link:
https://www.unpac.me/results/f986958b-b7b4-42e6-a8b5-31671a84345d/
SH256 hash:
c00640cc14fcff47ac94631050b5a7bf9e164cae4cfa4bce450be41af665b6f7
MD5 hash:
df00d944c138c8193329a0a98dc2d3e9
SHA1 hash:
5dd9ecfc8d1e8a21e1d46138a041ed9eedf2f39f
Link:
https://www.unpac.me/results/f986958b-b7b4-42e6-a8b5-31671a84345d/
Malware family:
SHADOWLADDER
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/739eba9ecc9a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GhostPulse

Executable exe 739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e

(this sample)

  
Link
https://tria.ge/260605-zeajaadx4v/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/69277/
  
URLhaus
https://urlhaus.abuse.ch/url/3853312/

Comments