MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 31 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528
SHA3-384 hash: 6b48200d4865f43901c61ed2e08ba37ffd2ee4e1336dc86cef5658f571e0fcb598a7dd413785e764a1a308ace0d8c576
SHA1 hash: a634d567131c5ae3a39e3684f77f1bee7b9f8f6b
MD5 hash: 1eb8107ee62b70b059cadf2e6d148b11
humanhash: mexico-may-freddie-seven
File name:file
Download: download sample
File size:6'859'912 bytes
First seen:2026-02-02 15:17:23 UTC
Last seen:2026-02-02 16:37:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4035d2883e01d64f3e7a9dccb1d63af5 (47 x ServHelper, 35 x Vidar, 20 x LummaStealer)
ssdeep 49152:gnwxDhbDfBO0j2h5C29PUy3R9Jkxpqcrqh4nBG90s167IxW3EN90jCZQfel5yF1q:RV3bj25NDf2XFU
Threatray 2 similar samples on MalwareBazaar
TLSH T1F0664B22FD9A45A6C6BFE23494A052517A31349583313FD32ED819BB097AFC8273F719
gimphash de677e4b2711eea3fa663b554f896bc82ae91c20ec7712a53f13c4840095788c
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543 signed

Code Signing Certificate

Organisation:virustotal.com
Issuer:WR3
Algorithm:sha256WithRSAEncryption
Valid from:2026-01-11T03:10:14Z
Valid to:2026-04-11T04:02:26Z
Serial number: 83bbec4d7556912510c20a1999ae9540
Intelligence: 13 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: ff17e465e73fb74c9ed4b303c8a8a9b1f00aa0270ac87dfc3a67c66d1563c8f7
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
Bitsight
url: http://130.12.180.43/files/7782139129/4utgF9B.exe

Intelligence

File Origin
# of uploads :
12
# of downloads :
120
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2026-02-02 15:19:38 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/cacd3d5a-00bf-445e-b734-e5b844c3b3a4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51246/
Verdict:
Clean
Score:
N/A%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6980c04e0bdf9fb6cc095c10
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-vm golang overlay rozena signed
Link:
https://www.filescan.io/uploads/6980c0462ffccda097660d22/reports/55055feb-48f0-4256-b828-7bbadf19557e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528
Result
Gathering data
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/28b69f16-48bb-4fbc-8df9-23cff0481a31
Score:
53%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528/
Verdict:
Malicious
Threat:
Trojan-PSW.Win32.ACRstealer
Link:
https://tip.neiki.dev/file/928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=skfpitueg7oujw5qjvawyhco32votuwvm4kkhw7utduojsqfiuua._file
Verdict:
malicious
Label(s):
amaterastealer
Create hunting rule
Similar samples:
631c708c5e8369a61239fde45e4b186bc375461cdf908ad82e4d7f817e8c2103
928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528
error
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery spyware
Link:
https://tria.ge/reports/260202-spvtmscz2d/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Unpacked files
SH256 hash:
928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528
MD5 hash:
1eb8107ee62b70b059cadf2e6d148b11
SHA1 hash:
a634d567131c5ae3a39e3684f77f1bee7b9f8f6b
Link:
https://www.unpac.me/results/bb4094ed-5ada-4a94-8b2d-1eef170ce500/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/928af44e8437/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:WIN_FileFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects FileFix social engineering technique that launches chained PowerShell and PHP commands from file explorer typed paths
Reference:FileFix social engineering with PowerShell and PHP commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 928af44e8437dd44dbb04d416c1c4edeaae9d2d56714a3dbf498e8e4ca054528

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3770683/
Cape
Cape
https://www.capesandbox.com/analysis/51246/

Comments