🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8aeec800c161af3f2df217f16663c02e57fcd94ed16f108bf5ec306d66e2a321. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 40 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8aeec800c161af3f2df217f16663c02e57fcd94ed16f108bf5ec306d66e2a321
SHA3-384 hash: 9106e97a36fe64bf4d5059e05388161071af4423fb2429182aef779749bdf85c6801b1aee158654a9ecc7c7fc8f11d8e
SHA1 hash: 7b7a559ee07ef50d181a677598ff7b48b9310d96
MD5 hash: 037e343ca61034e2c6e612ac56ba3a09
humanhash: nineteen-spring-bluebird-fanta
File name:Bulbulo.exe
Download: download sample
File size:63'296'467 bytes
First seen:2026-10-12 20:41:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash bfdf360405e2a60f93db21d6a40d07ec (1 x DiscordTokenStealer)
ssdeep 786432:M9HlkOm63XdIxO1MiBOe/0sakUgCphHZKT8/5:M9HlkOj3XOEMHe/0W2ZKC
TLSH T10FD7BE0673E601EDE9B3D1388AA75107D7B3B8625730CADF325C06612FAB6D0993B725
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon f89efcf8f971f2e0 (10 x NodeLoader, 9 x FixStealer, 6 x Amadey)
Reporter Anonymous
Tags:exe kurdishmyth MythJs MythPrivate RAT stealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/73eefead-5420-4ae3-9a4a-67c7e9200b99/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-12 20:56:02 UTC
Tags:
arch-doc arch-html arch-scr auto-reg discord stealer microstealer openssl tool nodejs websocket
Link:
https://app.any.run/tasks/a7b57366-7ab2-46a8-b90b-482de2756a0e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Creating a file
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Creating synchronization primitives
Reading critical registry keys
Changing a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Forced shutdown of a browser
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto expand fingerprint lolbin microsoft_visual_cc overlay packed packed pkg reconnaissance
Link:
https://www.filescan.io/uploads/6acd462b39da26cc872c1ab0/reports/be2471a0-983f-429d-ba44-ea57249b6b08/overview
Verdict:
Malicious
Labled as:
Trojan.Win64.Agent.oa
Link:
https://www.hybrid-analysis.com/sample/8aeec800c161af3f2df217f16663c02e57fcd94ed16f108bf5ec306d66e2a321
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-12T18:41:00Z UTC
Last seen:
2026-10-12T18:56:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8aeec800c161af3f2df217f16663c02e57fcd94ed16f108bf5ec306d66e2a321/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1983687
Signature
Creates autostart registry keys to launch java
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1983687 Sample: Bulbulo.exe Startdate: 07/10/2026 Architecture: WINDOWS Score: 96 68 mr-b01.tm-azurefd.net 2->68 70 corretto.aws 2->70 72 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->72 82 Multi AV Scanner detection for submitted file 2->82 84 Sigma detected: New RUN Key Pointing to Suspicious Folder 2->84 86 Joe Sandbox ML detected suspicious sample 2->86 88 2 other signatures 2->88 10 Bulbulo.exe 5 2->10         started        signatures3 process4 dnsIp5 76 corretto.aws 18.160.71.123, 443, 49708 AMAZON-02-AmazoncomIncUS United States 10->76 56 C:\Users\user\AppData\...\javaw-pack.jar, Zip 10->56 dropped 58 C:\Users\user\...\amazon-corretto-8.zip, Zip 10->58 dropped 98 Suspicious powershell command line found 10->98 100 Found many strings related to Crypto-Wallets (likely being stolen) 10->100 15 powershell.exe 931 10->15         started        19 powershell.exe 14 10->19         started        21 conhost.exe 10->21         started        file6 signatures7 process8 file9 60 C:\Users\user\AppData\Local\Temp\...\zip.dll, PE32+ 15->60 dropped 62 C:\Users\user\AppData\...\w2k_lsa_auth.dll, PE32+ 15->62 dropped 64 C:\Users\user\AppData\Local\...\verify.dll, PE32+ 15->64 dropped 66 213 other files (212 malicious) 15->66 dropped 78 Found many strings related to Crypto-Wallets (likely being stolen) 15->78 80 Powershell drops PE file 15->80 23 java.exe 19->23         started        signatures10 process11 dnsIp12 74 162.159.137.232 CLOUDFLARENET-CloudflareIncUS Canada 23->74 50 C:\Users\user\AppData\...\cookies.sqlite-shm, data 23->50 dropped 52 sqlite-3.50.3.0-9b...ab51-sqlitejdbc.dll, PE32+ 23->52 dropped 54 C:\Users\user\...\jna6045061938132022763.dll, PE32+ 23->54 dropped 90 Suspicious powershell command line found 23->90 92 Found many strings related to Crypto-Wallets (likely being stolen) 23->92 94 Creates autostart registry keys to launch java 23->94 96 4 other signatures 23->96 28 powershell.exe 23->28         started        30 powershell.exe 23->30         started        32 powershell.exe 23->32         started        34 5 other processes 23->34 file13 signatures14 process15 process16 36 conhost.exe 28->36         started        38 conhost.exe 30->38         started        40 conhost.exe 32->40         started        42 conhost.exe 34->42         started        44 conhost.exe 34->44         started        46 conhost.exe 34->46         started        48 conhost.exe 34->48         started       
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8aeec800c161af3f2df217f16663c02e57fcd94ed16f108bf5ec306d66e2a321
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rlxmqagbmgxt6lpsc7ywmy6afzl7zwko2fxrbc7v5qyg2zxcumqq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
credential_access defense_evasion discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/261012-zllvwsez8t/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads the TCP/IP host and domain name from the registry
Command and Scripting Interpreter: PowerShell
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202409_html_FedEx_phish
Create hunting rule
Author:abuse.ch
Description:Detects potential HTML FedEx phishing forms
Rule name:APT_Bitter_ZxxZ_Downloader
Create hunting rule
Author:SECUINFRA Falcon Team (@SI_FalconTeam)
Description:Detects Bitter (T-APT-17) ZxxZ Downloader
Reference:https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh
Rule name:attack_India
Create hunting rule
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:skip20_sqllang_hook
Create hunting rule
Author:Mathieu Tartare <mathieu.tartare@eset.com>
Description:YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:https://www.welivesecurity.com/
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:SUSP_HTML_XMLHTTP_Redirect_Kit
Create hunting rule
Author:Marjoriefort
Description:HTML avec exfiltration XMLHTTP + redirection window.location - kit phishing frais
Reference:Veille fraicheur 2026-09-14 / cluster HTML
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TigerRAT_pe_yaraify
Create hunting rule
Author:hunts-yara-code
Description:YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:WinosStager
Create hunting rule
Author:YungBinary
Description:https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
Rule name:Win_FakeInstaller_PythonShellcodeLoader_Crepectl_2026
Create hunting rule
Author:SixHands
Description:Detects the analyzed fake installer sample using .key config, XOR key, and Python/fiber shellcode loader traits
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments