MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DeerStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 7 File information Comments

SHA256 hash:	98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba
SHA3-384 hash:	4c1ae6f1b406ce9204a19249e4d5249c4c1ac902c2bff3ac234a87523b5ebb61803a93c75a892c6d455dcdeddf6fce49
SHA1 hash:	69ee8765b1ae11e588c74ee6f0daf949ebf276df
MD5 hash:	ac3ee999d900b080b340711445558984
humanhash:	neptune-yankee-leopard-victor
File name:	ac3ee999d900b080b340711445558984.exe
Download:	download sample
Signature	DeerStealer Create hunting rule
File size:	3'522'560 bytes
First seen:	2025-08-22 14:45:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8d6a06a9946b41554b4eabd6890d8c46 (20 x LummaStealer, 2 x Rhadamanthys, 2 x Stealc)
ssdeep	49152:WivwY8c5VLtPmT5zGHwyfHcWZkz4Y0GrYUPc4O2I/tZTHKiSqmiJ:N4Y73ETNLLWe1BrbPc4fgTdSq7
Threatray	1 similar samples on MalwareBazaar
TLSH	T199F51218F875A1D7FCD340B1A75A9251A423BD378F286AEB41E8C7502116EED0A3E377
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	DeerStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

https://mega.nz/file/L9w0wA6C#k72sjSN0jp8-rjqQEzdRZH0X1qJSexbDVRRL-lTEFPs

Verdict:

Malicious activity

Analysis date:

2025-08-22 11:32:23 UTC

Tags:

auto generic gcleaner loader lumma stealer amadey redline botnet arch-exec stealc quasar rat telegram phishing storm1747 tycoon themida mimikatz tools evasion screenconnect rmm-tool ultravnc rdp autoit anti-evasion vidar n-w0rm worm auto-sch-xml discord scan telnet telnetscan zgrat netreactor purehvnc ims-api inno installer delphi rust qrcode g0njxa

Link:

https://app.any.run/tasks/ab7089e9-a66a-4114-a9ac-d575e315f4f4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/22962/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a882b6e9d9dbcfd96d1701

Tags:

virus krypt

Result

Verdict:

Clean

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Restart of the analyzed sample

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/68a882a828a89d9dd4f244f2/reports/0e3d724d-9c72-4ec0-b935-eeb39f3476f8/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba

Verdict:

Clean

File Type:

exe x64

First seen:

2025-08-22T07:47:00Z UTC

Last seen:

2025-08-22T07:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/750e73c3-69b7-498f-92f0-d7f801dc57f2

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1762988

Signature

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Sets debug register (to hijack the execution of another thread)

Suricata IDS alerts for network traffic

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/ac3ee999d900b080b340711445558984

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba/

Verdict:

Malicious

Threat:

Family.DEERSTEALER

Link:

https://tip.neiki.dev/file/98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba

Threat name:

Win64.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-08-22 12:26:20 UTC

File Type:

PE+ (Exe)

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=td3cf4ak23dt6vtrjkf6kb77a4cxcw3ouhmnrggmwydlpcu3rw5a._file

Verdict:

malicious

Label(s):

deerstealer

DeerStealer

error

DeerStealer

Result

Malware family:

deerstealer

Score:

10/10

Tags:

family:deerstealer stealer

Link:

https://tria.ge/reports/250822-r4845sak3w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

DeerStealer

Deerstealer family

Detects DeerStealer

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/c4ef0c73-1757-47f0-baa6-dd091a87fa04

Unpacked files

SH256 hash:

98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba

MD5 hash:

ac3ee999d900b080b340711445558984

SHA1 hash:

69ee8765b1ae11e588c74ee6f0daf949ebf276df

Link:

https://www.unpac.me/results/b8e77217-3922-46c7-866f-d1439c1cf5f0/

Malware family:

DeerStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/98f622f00ad6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/98f622f00ad6c73f56714a8be507ff0705715b6ea1d8d898ccb606b78a9b8dba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)