MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7f02413b1cf40739a6b8cf528f4a18272564e3d916f75542a7a15da2beb0fc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WallStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7f02413b1cf40739a6b8cf528f4a18272564e3d916f75542a7a15da2beb0fc7
SHA3-384 hash: f7da8d8f791bbba077c89739c88b48356a360f59210add021a67fabb32a31ab505afb921622f8a1b5e5b942635223e06
SHA1 hash: ef6a80316b2be4624467c008752f815eda9c0269
MD5 hash: ad4cf080c9013acc42fb6b9b771a362c
humanhash: crazy-lemon-mexico-nebraska
File name:GitRelease.exe
Download: download sample
Signature WallStealer
Create hunting rule
File size:78'181'167 bytes
First seen:2026-03-16 07:45:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7a5e2524b66da5177b4ec46d305a3dd7 (1 x WallStealer)
ssdeep 1572864:OXY0/4G2OoiwKTE/QtqbPd6RgzzAZzkBMwpbMTWDAYo93j:oY+d/c4tqUCzzANGMgqT
TLSH T1FB083329C08092AFE3F1BE3598C9F9F149092B2C7AB9065EDD5A207DF390D45DF0CA59
TrID 40.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.0% (.EXE) Win64 Executable (generic) (6522/11/2)
12.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.0% (.EXE) Win32 Executable (generic) (4504/4/1)
5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter tcains1
Tags:exe WallStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
GitRelease.exe
Verdict:
Malicious activity
Analysis date:
2026-03-16 07:47:03 UTC
Tags:
anti-evasion evasion telegram ims-api generic github nodejs
Link:
https://app.any.run/tasks/93218b22-c007-4b17-af70-48acc70279e7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69b7b55c88c80c01586aab7a
Tags:
shellcode vmdetect shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a window
Searching for synchronization primitives
Unauthorized injection to a recently created process
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Running batch commands
Creating a process with a hidden window
Loading a suspicious library
Launching a process
Using the Windows Management Instrumentation requests
DNS request
Adding an access-denied ACE
Connection attempt
Sending a custom TCP request
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
installer installer installer-heuristic microsoft_visual_cc overlay packed
Link:
https://www.filescan.io/uploads/69b7b5442000fc76c3e186dd/reports/ab0739c2-0b8f-47a6-9686-ac8e6a865099/overview
Verdict:
Suspicious
Labled as:
Malware_51.0
Link:
https://www.hybrid-analysis.com/sample/a7f02413b1cf40739a6b8cf528f4a18272564e3d916f75542a7a15da2beb0fc7
Verdict:
Malicious
File Type:
exe x32
Detections:
HEUR:Trojan-Spy.JS.Screen.gen HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/a7f02413b1cf40739a6b8cf528f4a18272564e3d916f75542a7a15da2beb0fc7/results?tab=lookup
Score:
65%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/a7f02413b1cf40739a6b8cf528f4a18272564e3d916f75542a7a15da2beb0fc7
Gathering data
Verdict:
Malicious
Threat:
Trojan-Spy.JS.Screen
Link:
https://tip.neiki.dev/file/a7f02413b1cf40739a6b8cf528f4a18272564e3d916f75542a7a15da2beb0fc7
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u7ycie5rz5ahhgtlrt2sr5fbqjzfmtr5sfxxkvbkpik5uk7lb7dq._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion discovery execution
Link:
https://tria.ge/reports/260316-jl3weafw41/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Drops file in Windows directory
Enumerates processes with tasklist
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Looks for VMWare services registry key.
Enumerates VirtualBox registry keys
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

WallStealer

Executable exe a7f02413b1cf40739a6b8cf528f4a18272564e3d916f75542a7a15da2beb0fc7

(this sample)

  
Delivery method
Distributed via web download

Comments