MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8aa6842c690bb9bef6e02625e5be25fd23c32a3530feee58611c826e53f6c478. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 14

Intelligence 14 IOCs YARA 12 File information Comments

SHA256 hash:	8aa6842c690bb9bef6e02625e5be25fd23c32a3530feee58611c826e53f6c478
SHA3-384 hash:	2b93668de6064de11e9af9fd385d9a2867d7d4dcfe3db8568dec26ffd1df6ec27b5d088d23706cfdaf9c32ec458b2c91
SHA1 hash:	2e33714691c972c4b222074e2057735bd0504b10
MD5 hash:	417709ffea74558eb2eb4839d05759f0
humanhash:	triple-music-may-mexico
File name:	SecuriteInfo.com.Trojan.DownLoad4.18009.14847.21239
Download:	download sample
File size:	36'864 bytes
First seen:	2026-10-08 06:29:55 UTC
Last seen:	2026-10-08 07:32:37 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'298 x AgentTesla, 20'717 x Formbook, 12'402 x SnakeKeylogger)
ssdeep	768:umQZqx1lYcJnqnaFFzv1ID2K3omDe0XbOfC11kqam:u0lYov1ID13omCMbO/qam
TLSH	T107F25C48BB98C12FDA5F0E7D64A20661127196620103DB8A7DCC65EFFFA77408A25FC7
TrID	69.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win64 Executable (generic) (6522/11/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

184

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PS2EXE

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ad2ec75a-223c-4735-b7ce-a099c457aeaa/

Malware family:

n/a

ID:

File name:

Loader.exe

Verdict:

Malicious activity

Analysis date:

2025-10-19 15:16:54 UTC

Tags:

pastebin github anti-evasion rhadamanthys stealer lumma

Link:

https://app.any.run/tasks/a1443127-b4d6-44b3-b9a5-958b24389bfe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91055/

Detection(s):

SecuriteInfo.com.Trojan.DownLoad4.18009.14847.21239.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad05a2b6f551121ba15b9a1

Tags:

virus micro msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Deleting a recently created file

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Creating a file

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Stealerc

Link:

https://www.hybrid-analysis.com/sample/8aa6842c690bb9bef6e02625e5be25fd23c32a3530feee58611c826e53f6c478

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-22T13:06:00Z UTC

Last seen:

2026-10-09T17:27:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/8aa6842c690bb9bef6e02625e5be25fd23c32a3530feee58611c826e53f6c478/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f35cba77-7e1a-4e6f-866d-9354eea9d6b0

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8aa6842c690bb9bef6e02625e5be25fd23c32a3530feee58611c826e53f6c478

Verdict:

Malware

YARA:

8 match(es)

Tags:

.Net DeObfuscated Executable Managed .NET PE (Portable Executable) PE File Layout PowerShell SOS: 0.34 T1027 T1059.001 T1105 Win 32 Exe x86

Link:

https://app.malva.re/file/417709ffea74558eb2eb4839d05759f0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8aa6842c690bb9bef6e02625e5be25fd23c32a3530feee58611c826e53f6c478/

Threat name:

Win32.Infostealer.Generic

Status:

Suspicious

First seen:

2025-09-22 19:01:13 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 36 (63.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rktiildjbo4355xaeys6lprf7ur4gkrvgd7o4wdbdsbg4u7wyr4a._file

Verdict:

malicious

Label(s):

ADMINTOOL_PS2EXE

Link:

https://reports.threatray.com/fc9a66fc-73d7-49fa-b188-8b5e7fc24165

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery

Link:

https://tria.ge/reports/261008-g9sz1a11h1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Reads the TCP/IP host and domain name from the registry

Contacts third-party web service commonly abused for C2

Unpacked files

SH256 hash:

8aa6842c690bb9bef6e02625e5be25fd23c32a3530feee58611c826e53f6c478

MD5 hash:

417709ffea74558eb2eb4839d05759f0

SHA1 hash:

2e33714691c972c4b222074e2057735bd0504b10

Detections:

INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Link:

https://www.unpac.me/results/363bbc00-ce52-4992-8c07-22ea391ea624/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.77

Link:

https://yomi.yoroi.company/submissions/8aa6842c690bb9bef6e02625e5be25fd23c32a3530feee58611c826e53f6c478

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Detect_Zoom_Invite_malware_RAT_C2 Create hunting rule
Author:	daniyyell
Description:	Detects Zoom Invite Call Leading to Malware Hosted in Telegram C2

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL Create hunting rule
Author:	ditekSHen
Description:	Detects executables (downlaoders) containing URLs to raw contents of a paste

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_Scheduled_Tasks_Create_From_Susp_Dir Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory

Rule name:	SUSP_Websites Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference of suspicious sites that might be used to download further malware

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe