MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9838584fba1ebdf51d3fcd9cb0d5461d92001e574adafc826dc3ce914f7304b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 11

Intelligence 11 IOCs YARA 10 File information Comments

SHA256 hash:	9838584fba1ebdf51d3fcd9cb0d5461d92001e574adafc826dc3ce914f7304b8
SHA3-384 hash:	f8f6da999318216c041650dd798f07d63def57b44a6163cf39ad99f4bf645e0f45a134105fba8f5c6a33cd40966d580b
SHA1 hash:	b8670f6e956f5f2fe6bc82dac2ef7253d093fc93
MD5 hash:	89be18c970779202b181e87c95aa71bd
humanhash:	hawaii-fourteen-double-kilo
File name:	file
Download:	download sample
Signature	Stealc Create hunting rule
File size:	706'048 bytes
First seen:	2026-09-25 14:13:24 UTC
Last seen:	2026-09-25 14:21:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	cf2d6be82c4139af66116bba782f0267 (1 x Stealc)
ssdeep	12288:cbJIS+LL7aTVbNMyFvImAdjT3gT46QCsANUEGORNbj7lWqUnoecL9L19AO:+SVyFvvAdQ+EGcbjxrUnodL9L19A
TLSH	T127E4F126B1B69C13D176C8B88D21DA801D75BDEAAD906EC373C43FEE0E211664BB5533
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Bitsight
Tags:	54e64e dropped-by-amadey exe Stealc

Bitsight

url: http://91.92.242.236/files-129312398/files/file_50716ee6321eab1f.exe

Intelligence

File Origin

# of uploads :

# of downloads :

301

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-09-25 14:23:29 UTC

Tags:

stealc stealer

Link:

https://app.any.run/tasks/cc6917d2-5131-4701-b2d2-3e44d8d4a3eb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/88986/

Detection(s):

Win.Malware.Generickdz-10058619-0

YARA.RUSSIANPANDA_Win_Mal_Chromium_App_Bound_Encryption_Decrypter.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP POST request to an infection source

Connection attempt to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug base64 crypto crypto evasive fingerprint overlay packed

Link:

https://www.filescan.io/uploads/6ab681b5602e17bd916124ff/reports/5a414478-ff3c-482c-a2d5-fc82614ce180/overview

Verdict:

Malicious

Labled as:

Shellcode.Loader.Marte.X.Generic

Link:

https://www.hybrid-analysis.com/sample/9838584fba1ebdf51d3fcd9cb0d5461d92001e574adafc826dc3ce914f7304b8

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-25T12:21:00Z UTC

Last seen:

2026-09-27T08:54:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/9838584fba1ebdf51d3fcd9cb0d5461d92001e574adafc826dc3ce914f7304b8/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/fed57e13-adc5-4d86-b111-357660db3a98

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9838584fba1ebdf51d3fcd9cb0d5461d92001e574adafc826dc3ce914f7304b8

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/89be18c970779202b181e87c95aa71bd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9838584fba1ebdf51d3fcd9cb0d5461d92001e574adafc826dc3ce914f7304b8/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2026-09-25 14:14:20 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ta4fqt52d267khj7zwolbvkgdwjaahsxjlnpzatnyphjct3tas4a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery spyware stealer

Link:

https://tria.ge/reports/260925-rj3rmaef38/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

9838584fba1ebdf51d3fcd9cb0d5461d92001e574adafc826dc3ce914f7304b8

MD5 hash:

89be18c970779202b181e87c95aa71bd

SHA1 hash:

b8670f6e956f5f2fe6bc82dac2ef7253d093fc93

Link:

https://www.unpac.me/results/83f60371-1cb1-44b7-9462-08fc4ed26cf5/

SH256 hash:

c4d37b20005b55afce3748337a35dfebc31dd8a06c808849a6c5e74e6b25d03b

MD5 hash:

e26ee32fefe1cfca2ec8bd0bfc7d4c71

SHA1 hash:

0ed361a7118ce2d755a34f368718593ea91eb2d0

Link:

https://www.unpac.me/results/83f60371-1cb1-44b7-9462-08fc4ed26cf5/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9838584fba1e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9838584fba1ebdf51d3fcd9cb0d5461d92001e574adafc826dc3ce914f7304b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	suspicious_PEs Create hunting rule
Author:	txc
Description:	This rule detected suspicious PE files, based on high entropy and low amount of imported DLLs. This behaviour indicates packed files or files, that hide their true intention.

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.