MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012
SHA3-384 hash: 94aad627d0c068127a8d48e1cf3fcb08a81248ada7fc1ad22d2171c343de0d5a1f97b7091f2fc42fe165b7a5054886ed
SHA1 hash: 128d921b2200fa96cae6076c7e44b6359e8bff22
MD5 hash: 511f859cacc58d37186eb3262362ce4b
humanhash: hot-harry-delta-black
File name:Nitro-Gen.exe
Download: download sample
Signature CStealer
Create hunting rule
File size:18'686'326 bytes
First seen:2026-07-30 09:51:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cf72283be50852e418ce6bbb6b645835 (32 x Adware.Yogi, 10 x Efimer, 7 x BlankGrabber)
ssdeep 393216:oqmn7LMfgIfUKOcFXEAphVtnIwQSg+j/iZvatLMovF79Lplo:oqq4f58KPFRphDBo+jiZStL7vF76
TLSH T1171733A8FBC14DBAE8E7413C59A48D12E2B172491F95D2FF07F006262D376E14B3D2A5
TrID 65.5% (.EXE) InstallShield setup (43053/19/16)
9.9% (.EXE) Win64 Executable (generic) (6522/11/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.6% (.APP) GEM Application (Intel) (5000/1/1)
3.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon a8308dde4e4ccd22 (1 x CStealer)
Reporter lighting9999
Tags:CStealer exe SliverFox

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
PyInstaller
Details
Link:
https://research.acce.ciphertechsolutions.com/results/19dcde95-9132-4b59-ac60-47c84be05e56/
Malware family:
n/a
ID:
1
File name:
https://www.mediafire.com/file/mcc8a3usqke75qc/Nitro-Gen.exe/file
Verdict:
Malicious activity
Analysis date:
2026-07-29 12:00:33 UTC
Tags:
evasion python uac ip-check pastebin stealer discord gofile loader pyinstaller generic openssl tool
Link:
https://app.any.run/tasks/80273042-e55a-456b-a94b-c75b98b7d4c8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76826/
Detection(s):
SecuriteInfo.com.Trojan.Siggen32.64178.20691.30262.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
Creating a window
Running batch commands
Creating a process with a hidden window
Launching a process
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Creating a file
DNS request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug expand lolbin microsoft_visual_cc overlay packed packed pyinstaller reconnaissance
Link:
https://www.filescan.io/uploads/6a6b1ed637d050fb105bd36a/reports/8cbb8e3c-1b93-4f15-9c09-bad55ba9f33c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-10T18:23:00Z UTC
Last seen:
2026-08-01T07:11:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012/results?tab=lookup
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/511f859cacc58d37186eb3262362ce4b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012/
Threat name:
Win64.Adware.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-11 00:01:57 UTC
File Type:
PE+ (Exe)
Extracted files:
1037
AV detection:
17 of 36 (47.22%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3ymxs37fqoun4t7utmeygdrrz32ofi5ewjt4yqhgiy2ba4duaja._file
Result
Malware family:
cstealer
Create hunting rule
Score:
  10/10
Tags:
family:cstealer credential_access defense_evasion discovery execution persistence pyinstaller spyware stealer
Link:
https://tria.ge/reports/260730-lv85wsgl7z/
Behaviour
Kills process with taskkill
Runs net.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Browser Information Discovery
Executes a command shell one-liner
Permission Groups Discovery: Local Groups
Creates a new local user account
Enumerates processes with tasklist
Accesses cryptocurrency files/wallets, possible credential harvesting
Contacts third-party web service commonly abused for C2
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Indicator Removal: Network Share Connection Removal
Grants admin privileges
Unpacked files
SH256 hash:
a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012
MD5 hash:
511f859cacc58d37186eb3262362ce4b
SHA1 hash:
128d921b2200fa96cae6076c7e44b6359e8bff22
Link:
https://www.unpac.me/results/9cd38db7-4f10-40fe-8071-2542ae816a3c/
SH256 hash:
032b490f6b42a0928b3cb6e17fd4caf8a6becaaf05739c4fe41267dcf890c278
MD5 hash:
e58f635d100bd8d6e27d50253f0ba9d7
SHA1 hash:
a7a73a53fafa50b6614fc1956abdc769d7b010d5
Link:
https://www.unpac.me/results/9cd38db7-4f10-40fe-8071-2542ae816a3c/
SH256 hash:
22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
MD5 hash:
a5495a547b4218148914469f1ee65d47
SHA1 hash:
91632b2965ae22db25edce6971cf59c0a3a00bba
Link:
https://www.unpac.me/results/9cd38db7-4f10-40fe-8071-2542ae816a3c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/76826/

Comments