🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76110b464e593e2c38d01e421eac7566c77f379c1dad4cbae81de3fa987b35e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76110b464e593e2c38d01e421eac7566c77f379c1dad4cbae81de3fa987b35e8
SHA3-384 hash: 9941f8e5decd54a1c2a8b70e1278f79eeccd5701d8cf0df0535f148390574cab41e83c4561308774ad7da1bc835f67ab
SHA1 hash: 6d46926b997b9549076cca59d1d698d85c583617
MD5 hash: d28270050d2c229407a2ee98faea74df
humanhash: dakota-beryllium-golf-spring
File name:CramAPI.msi
Download: download sample
Signature RevStealer
Create hunting rule
File size:19'808'256 bytes
First seen:2026-11-15 15:55:47 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:hN1oY4P6in9roqgHbj3SxcPJ+RbKM3l4hNJctFr6MnvcD1s/rw9PZ5sPt7BkOT5O:PmoiBoqgHb+xc8bPinytcMvgs/rI5O
TLSH T190172367B8361CA7C6506D72534A1B0AAF711DB03F028B521A36F00E2D7E9E96B5D3C7
TrID 53.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
39.2% (.MSP) Windows Installer Patch (44509/10/5)
7.0% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter rifteyy
Tags:msi nodejs RevStealer signed stealer

Code Signing Certificate

Organisation:ValleyPoint Runtime Components SRL
Issuer:ValleyPoint Runtime Components SRL
Algorithm:sha256WithRSAEncryption
Valid from:2025-04-14T20:55:59Z
Valid to:2030-11-09T20:55:59Z
Serial number: 5a35df8bec08baab4a0b86140cca72e1
Thumbprint Algorithm:SHA256
Thumbprint: 1f0016e00cb5e3a3192c2adca4e3cc62c200a72e2b05d262c2f1cf63024fe6f0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
CZ CZ
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/86220c43-8748-475b-9410-843953926171/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/100148/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af9d61efc945c1ebf2a42ed
Tags:
n/a
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Searching for synchronization primitives
Connection attempt
Creating a file in the Windows subdirectories
Sending a custom TCP request
Creating a file
Creating a process from a recently created file
Moving a recently created file
Creating a file in the %temp% subdirectories
Deleting a recently created file
DNS request
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug CAB expired-cert installer installer reconnaissance signed
Link:
https://www.filescan.io/uploads/6af9d61b1cecf03ed5728d62/reports/e29b1a5c-3324-44ab-a76b-01dda22ca368/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/76110b464e593e2c38d01e421eac7566c77f379c1dad4cbae81de3fa987b35e8
Verdict:
Clean
File Type:
msi
Link:
https://opentip.kaspersky.com/76110b464e593e2c38d01e421eac7566c77f379c1dad4cbae81de3fa987b35e8/results?tab=lookup
Result
Threat name:
RevStealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2006427
Signature
AI detected suspicious PE / MSI digital signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates / moves files in alternative data streams (ADS)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Modifies the context of a thread in another process (thread injection)
Queries DNS domain through GetComputerNameExW (potential sandbox evasion)
Sets debug register (to hijack the execution of another thread)
Sigma detected: Powershell Defender Disable Scan Feature
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Yara detected RevStealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2006427 Sample: CramAPI.msi Startdate: 15/11/2026 Architecture: WINDOWS Score: 100 77 edge.gardenreport89.work 2->77 83 Suricata IDS alerts for network traffic 2->83 85 Found malware configuration 2->85 87 Antivirus detection for URL or domain 2->87 89 4 other signatures 2->89 12 msiexec.exe 501 1001 2->12         started        15 msiexec.exe 3 2->15         started        signatures3 process4 file5 69 C:\Users\user\AppData\...\update-authors.sh, POSIX 12->69 dropped 71 C:\Users\user\AppData\Local\...\gen-changelog, POSIX 12->71 dropped 73 C:\Users\user\AppData\Local\...\setup.py, Python 12->73 dropped 75 15 other files (none is malicious) 12->75 dropped 17 msiexec.exe 12->17         started        process6 process7 19 node.exe 18 17->19         started        24 node.exe 6 17->24         started        dnsIp8 79 196.251.107.48, 49715, 80 FEMOITGB Germany 19->79 81 edge.gardenreport89.work 104.21.5.149, 443, 49714 CLOUDFLARENET-CloudflareIncUS Canada 19->81 61 C:\Users\user\AppData\Local\Temp\...\ki.chk, PE32+ 19->61 dropped 63 C:\Users\user\AppData\Local\...\rkkzxgbh.chk, PE32+ 19->63 dropped 65 C:\Users\user\AppData\...\koo5y5332b.exe, PE32 19->65 dropped 93 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->93 95 Creates / moves files in alternative data streams (ADS) 19->95 97 Tries to harvest and steal ftp login credentials 19->97 103 7 other signatures 19->103 26 koo5y5332b.exe 8 19->26         started        29 conhost.exe 19->29         started        31 chrome.exe 19->31         started        99 Tries to detect virtualization through RDTSC time measurements 24->99 101 Unusual module load detection (module proxying) 24->101 33 conhost.exe 24->33         started        file9 signatures10 process11 file12 67 C:\Users\user\AppData\...\XboxIconMonitor.exe, PE32+ 26->67 dropped 35 XboxIconMonitor.exe 26->35         started        process13 signatures14 91 Uses cmd line tools excessively to alter registry or file data 35->91 38 reg.exe 35->38         started        41 reg.exe 35->41         started        43 reg.exe 35->43         started        45 7 other processes 35->45 process15 signatures16 105 Disable Windows Defender notifications (registry) 38->105 107 Disable Windows Defender real time protection (registry) 38->107 47 conhost.exe 38->47         started        49 conhost.exe 41->49         started        51 conhost.exe 43->51         started        53 conhost.exe 45->53         started        55 net1.exe 45->55         started        57 conhost.exe 45->57         started        59 5 other processes 45->59 process17
Score:
75%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/76110b464e593e2c38d01e421eac7566c77f379c1dad4cbae81de3fa987b35e8
Verdict:
Malware
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:MSZIP DeObfuscated Executable Office Document PDB Path PE (Portable Executable) PE File Layout PowerShell SVG T1027 T1059.001 T1059.007 T1105
Link:
https://app.malva.re/file/d28270050d2c229407a2ee98faea74df
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76110b464e593e2c38d01e421eac7566c77f379c1dad4cbae81de3fa987b35e8/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oyiqwrsole7cyogqdzbb5ldvm3dx6n44dwwuzoxidxr7vgd3gxua._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261115-tdehysfx7t/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Badlisted process makes network request
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Malware Family:
n/a
Verdict:
Malicious
Tags:
invalid_signature
YARA:
win_token ParentProcessEvasion
Link:
https://app.threat.zone/submission/f4a5f621-7b40-4685-a7a7-a97d318cdafa
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_SliverFox_String
Create hunting rule
Author:huoji
Description:Detect files is `SliverFox` malware
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/de058583-edb7-4016-b95a-cb10f1f13435
  
Link
https://www.hybrid-analysis.com/sample/76110b464e593e2c38d01e421eac7566c77f379c1dad4cbae81de3fa987b35e8
  
Link
https://tria.ge/261115-svpjtafw3s
Cape
Cape
https://www.capesandbox.com/analysis/100148/

Comments