MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 79e8323118247fead9209f30d8d0f8de9f77b7e615f68d2ec7ae5005ed839948. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ResolverRAT
Vendor detections: 15
| SHA256 hash: | 79e8323118247fead9209f30d8d0f8de9f77b7e615f68d2ec7ae5005ed839948 |
|---|---|
| SHA3-384 hash: | 77cd2d5325fed644ef3c9ae7b8b7faa40f72b5733cccb2b04d03498c8699a9edf784b94ab6cb91f2700b476026cf8f6e |
| SHA1 hash: | 5d8c04ab1a36a4e2d17e7c1aac5dee2701d0bf7d |
| MD5 hash: | 4d2695a3c919ef060d89694b3d8e81df |
| humanhash: | eight-leopard-wolfram-march |
| File name: | 4d2695a3c919ef060d89694b3d8e81df.exe |
| Download: | download sample |
| Signature | ResolverRAT |
| File size: | 1'218'048 bytes |
| First seen: | 2025-05-15 06:08:09 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 24576:vScyk3fL3wn98/K2RCyz1dXY5GNU0+PoZTjRTmkbN:Kcya68/RRCCdaGS5PoZ3RTme |
| Threatray | 3'398 similar samples on MalwareBazaar |
| TLSH | T1D6452374926C62A7F3E83B735CE4952B0FB0607C9A44E7AB3449A1198E313E91CD7D63 |
| TrID | 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| Reporter |  abuse_ch |
| Tags: | exe ResolverRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
436
Origin country :
NLVendor Threat Intelligence
Malware family:
amadey
ID:
1
File name:
8e0e31dd52a811ceff221fafcbd4f62e.exe
Verdict:
Malicious activity
Analysis date:
2025-05-15 06:16:07 UTC
Tags:
lumma stealer loader amadey botnet telegram uac gcleaner auto-reg auto-startup remote xworm rdp themida
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Verdict:
Malicious
Score:
81.4%
Tags:
smartassembly packed virus
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a file
Launching a process
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 obfuscated obfuscated packed packed packer_detected smartassembly smart_assembly
Verdict:
Malicious
Labled as:
Lazy.Generic
Verdict:
Malicious
Result
Threat name:
ResolverRAT, XWorm
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops large PE files
Drops PE files to the startup folder
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected ResolverRAT
Yara detected XWorm
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Jalapeno
Status:
Malicious
First seen:
2025-05-15 03:31:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
31 of 37 (83.78%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
purecrypter
Similar samples:
+ 3'388 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery persistence
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Verdict:
Malicious
Tags:
Win.Packed.Msilheracles-10017859-0
YARA:
n/a
Unpacked files
SH256 hash:
79e8323118247fead9209f30d8d0f8de9f77b7e615f68d2ec7ae5005ed839948
MD5 hash:
4d2695a3c919ef060d89694b3d8e81df
SHA1 hash:
5d8c04ab1a36a4e2d17e7c1aac5dee2701d0bf7d
SH256 hash:
57e3b5e778734fca83bc6431f33e2dc94a830ba3aba1c14139e23e1190c4c77b
MD5 hash:
1bf8c2182f9edf2889db82e2f93ff109
SHA1 hash:
146ef8cb6c6dabc58b15eb643669cc24437415b1
SH256 hash:
dc7ba6adda3be07460a08a0b175069f6ca2186625d049b206e81be99ddeaa12e
MD5 hash:
5a300d90d756896acc5cfb4e502f8da0
SHA1 hash:
14b8213294156c2f1d47fdf5d2bdcdb2cf62bc3c
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
c760e7dd15ebc93011cbd7deb7d4d711e3fc7af94081c4e509c5b91f39faae17
MD5 hash:
f9d24af844864dfafbb6e4d10f287471
SHA1 hash:
36bc83b98a73eda5c9c8a7444ae33c25b4524cf1
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
SH256 hash:
56a66b07c7010fdda0c50d60fda6a9b1c31a6e534ac07544bf738e529549f875
MD5 hash:
0bbc554f5e87d9da0e3b2b3a65ccf398
SHA1 hash:
c9b80c3e086adb2006b9ba5219e0805fc1542c19
SH256 hash:
86dd5bcdecff4a523749b6a916f43b6883a81409e5f476b86f47bb9e390928ec
MD5 hash:
0191ded1cb4c9fd99e017d17e763680b
SHA1 hash:
d4159b2cdc3a46f0cbaa29d50f92e73e139a6cf3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
XWorm
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Detect_PowerShell_Obfuscation |
|---|---|
| Author: | daniyyell |
| Description: | Detects obfuscated PowerShell commands commonly used in malicious scripts. |
| Rule name: | INDICATOR_EXE_Packed_SmartAssembly |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with SmartAssembly |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.