🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnappyClient


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42
SHA3-384 hash: e4baef362dbad22f5a5c7aaf328ce682a35bf4a9635b309cf1a717817b26a53c3a768dbddf8a9f4ece0442858d6659c5
SHA1 hash: 98c4acb3a0dd42ffb0942311ce5b4a0a0af6472e
MD5 hash: 99505f14a6ba31a2f2d6c673d7d6b3c8
humanhash: one-lake-yankee-eight
File name:bwes.ps1
Download: download sample
Signature SnappyClient
Create hunting rule
File size:4'508'835 bytes
First seen:2026-05-07 14:17:01 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12288:NK1AzT5tMUpYdu1whlf9to2I3GChnQIVe+mjM4Ess:N1txYdu10llta3hhnQMeRM4s
Threatray 18 similar samples on MalwareBazaar
TLSH T13526D13AC132FCCA4E9C3B42C5BA0E6B159C7945C7BB1D65DB0C2DFE35A2B909E10658
Magika powershell
Reporter aachum
Tags:ACRStealer ClickFix GhostSocks ps1 SnappyClient snowdrift-vineyardstudied-cfd ZigClipper


Avatar
iamaachum
https://b38a11a3.cloud-authentication.pages.dev/ => https://speedyharecheck.fit/bwes.7z

ACRStealer C2: snowdrift.vineyardstudied.cfd
ZigClipper C2: https://sp13.gstats-api-coni.co/
GhostSocks C2:
194.28.225.230:443
178.104.222.124:443
SnappyClient C2: 212.34.132.94:34759

Downloaded payloads (shellcode and ZIP):
https://ootid.srv-auth-dlt-msh.in.net/WriteVirtual
https://www.mediafire.com/file_premium/5j39qlwww1xd2x4/hpscantrdrvwn8.php/file
https://ootid.srv-auth-dlt-msh.in.net/pylupdate6in
https://ootid.srv-auth-dlt-msh.in.net/was0do6si2in
https://ohn.stainedunstitch.work/celqop-v9tp34n2-2ao43do-hv2wxcv-piojaip/hpwia2drvrootwn8.html

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 base64 encrypted evasive obfuscated packed powershell
Link:
https://www.filescan.io/uploads/69fc9ef5792fe2d217ad45cb/reports/6ce1851e-69f4-4740-8cd6-323f7ce560e1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42
Verdict:
Clean
File Type:
unix shell
Link:
https://opentip.kaspersky.com/af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42/results?tab=lookup
Result
Threat name:
ACR Stealer, DonutLoader, GhostSocks, Sn
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1910133
Signature
.NET source code contains very large array initializations
AI detected malicious Powershell script
Drops executable to a common third party application directory
Early bird code injection technique detected
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Unusual module load detection (module proxying)
Yara detected ACR Stealer
Yara detected DonutLoader
Yara detected GhostSocks
Yara detected PersistenceViaHiddenTask
Yara detected SnappyClient
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1910133 Sample: bwes.ps1 Startdate: 07/05/2026 Architecture: WINDOWS Score: 100 65 sp13.gstats-api-coni.co 2->65 67 snowdrift.vineyardstudied.cfd 2->67 69 12 other IPs or domains 2->69 105 Suricata IDS alerts for network traffic 2->105 107 Found malware configuration 2->107 109 Malicious sample detected (through community Yara rule) 2->109 111 9 other signatures 2->111 9 powershell.exe 20 2->9         started        13 pythonw.exe 2->13         started        15 pythonw.exe 2->15         started        17 vlc.exe 2->17         started        signatures3 process4 dnsIp5 89 snowdrift.vineyardstudied.cfd 104.21.34.106, 443, 49694 CLOUDFLARENETUS United States 9->89 91 ootid.srv-auth-dlt-msh.in.net 104.21.52.137, 443, 49695, 49696 CLOUDFLARENETUS United States 9->91 93 ohn.stainedunstitch.work 104.21.84.53, 443, 49698 CLOUDFLARENETUS United States 9->93 117 Early bird code injection technique detected 9->117 119 Found many strings related to Crypto-Wallets (likely being stolen) 9->119 121 Tries to harvest and steal ftp login credentials 9->121 123 8 other signatures 9->123 19 dllhost.exe 1 10 9->19         started        23 dllhost.exe 1 39 9->23         started        26 dllhost.exe 16 38 9->26         started        28 3 other processes 9->28 95 206.245.157.177, 443, 49727 WINDSTREAMUS United States 13->95 97 121.127.33.212, 443, 49733 RANATECHNET-AFRANATechnologiesKabulAF Afghanistan 13->97 99 7 other IPs or domains 13->99 signatures6 process7 dnsIp8 45 C:\Users\user\AppData\Roaming\...\vlc.exe, PE32 19->45 dropped 47 C:\Users\user\AppData\...\vcruntime140.dll, PE32 19->47 dropped 49 C:\Users\user\AppData\...\libvlccore.dll, PE32 19->49 dropped 57 2 other files (none is malicious) 19->57 dropped 113 Unusual module load detection (module proxying) 19->113 30 vlc.exe 19->30         started        79 172.67.199.181, 443, 49699, 49701 CLOUDFLARENETUS United States 23->79 51 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 23->51 dropped 53 C:\Users\user\AppData\Local\...\pythonw.exe, PE32+ 23->53 dropped 55 C:\Users\user\AppData\Local\...\python313.dll, PE32+ 23->55 dropped 59 26 other files (1 malicious) 23->59 dropped 115 Drops executable to a common third party application directory 23->115 34 pythonw.exe 12 23->34         started        81 httpbin.org 100.52.121.211, 443, 49712 UUNETUS United States 26->81 83 download2324.mediafire.com 199.91.155.65, 443, 49706 MEDIAFIREUS United States 26->83 87 4 other IPs or domains 26->87 61 30 other files (none is malicious) 26->61 dropped 37 pythonw.exe 1 26->37         started        85 104.21.30.230, 443, 49700 CLOUDFLARENETUS United States 28->85 39 conhost.exe 28->39         started        file9 signatures10 process11 dnsIp12 63 C:\Windows\Temp\~DF0FE810E0.tmp, PE32 30->63 dropped 129 Sample uses process hollowing technique 30->129 131 Tries to detect virtualization through RDTSC time measurements 30->131 133 Hides threads from debuggers 30->133 135 Switches to a custom stack to bypass stack traces 30->135 41 explorer.exe 30->41         started        71 sp13.gstats-api-coni.co 104.21.30.96, 443, 49720 CLOUDFLARENETUS United States 34->71 73 bsc.drpc.org 104.18.10.59, 443, 49719 CLOUDFLARENETUS United States 34->73 137 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 34->137 139 Unusual module load detection (module proxying) 34->139 141 Found direct / indirect Syscall (likely to bypass EDR) 34->141 75 194.28.225.230, 443, 49717 SYSTEM-LTD-ASRU Russian Federation 37->75 77 212.34.139.29, 20141, 49718 RAN-NETWORKSES Spain 37->77 file13 signatures14 process15 dnsIp16 101 178.104.222.124, 443, 49721, 49724 EELtdGB United Kingdom 41->101 103 example.com 172.66.147.243, 49722, 80 CLOUDFLARENETUS United States 41->103 125 System process connects to network (likely due to code injection or exploit) 41->125 127 Query firmware table information (likely to detect VMs) 41->127 signatures17
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42
Verdict:
Malware
YARA:
1 match(es)
Tags:
Base64 Block Contains Base64 Block DeObfuscated PowerShell
Link:
https://app.malva.re/file/99505f14a6ba31a2f2d6c673d7d6b3c8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v4y6wd7jz4zmveptuwdawlog2qb5qimify7e7uknddt6obdtlnba._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
Similar samples:
30103ca4c75758700d2aa823221e41031d064326ba215a541b2793091bc2ec65
SnappyClient
60d66fae1db934e7611163342c01806949710f1a708739caa028ad6de03bbfc5
SnappyClient
6ab0a51adc1ba6c83d4178e5de92b3d61b57e2bcdf3f142a17087815548d5e59
SnappyClient
7305daa8982d5a438feaabb78ddef96f65059be5304a69c918d04ffea99d49d8
SnappyClient
82a3ba5caa5b2485aae01a593f7ab4a3068d6b7ca367743fff8c6f0e8e81ae69
SnappyClient
8f3ae43e01f5f8965cba7e02646757d0a4a746ebb8735b864d458f63bdd59f36
SnappyClient
aa8b48023efb7fcfc7d52f895770210874aaaf7d52c39bea2830c930847d1e84
SnappyClient
b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3
SnappyClient
dba4a6533658e2cd0807a735eedcd00a0a069421f4f301f3e17b7328a9633aa4
SnappyClient
error
SnappyClient
+ 8 additional samples on MalwareBazaar
Result
Malware family:
snappyclient
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:snappyclient backdoor discovery execution loader persistence spyware stealer
Link:
https://tria.ge/reports/260507-rlxndsey5y/
Behaviour
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detects DonutLoader
Family: DonutLoader
Family: SnappyClient
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SnappyClient

PowerShell (PS) ps1 af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42

(this sample)

  
Link
https://tria.ge/260507-q1krpsew8t/behavioral2
  
Delivery method
Distributed via web download

Comments