🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f
SHA3-384 hash: b30396ab67ac9c0318ddc6d659be4f91b8ec240ae7f709bac563c5d0806e59484a30d407ab64b0728115c6624c683b29
SHA1 hash: 72214c2b44dcb92dcd429bedcfd743ffdab9edea
MD5 hash: e50eae63c7f97441772f8bffe1ca7112
humanhash: twelve-sweet-kilo-leopard
File name:b4e4178aea8498d952fec581ab3367c05a6272c444fac.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:2'655'297 bytes
First seen:2026-02-11 07:25:16 UTC
Last seen:2026-02-11 08:28:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 20dd26497880c05caed9305b3c8b9109 (38 x HijackLoader, 31 x Adware.Auslogics, 8 x SnappyClient)
ssdeep 49152:Y+dHu6h24LoOoGhy/JQ5jG4QiqdnjEopvX9V9LW0e7BEyR6DDcsQ0rQoY4pviM:XO6UOo/RQ5yviqy8/rxW0WEyYDDcx74d
TLSH T1B5C52302B3D718B1E5A50B719ABAC500FE177CA519F0905A3CF5D80E0E7A7E5CD36BA2
TrID 70.9% (.EXE) Inno Setup installer (107240/4/30)
9.3% (.EXE) Win32 Executable Delphi generic (14182/79/4)
6.9% (.EXE) Win64 Executable (generic) (10522/11/4)
4.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b298acbab2ca7a72 (2'335 x GCleaner, 1'830 x Socks5Systemz, 67 x RedLineStealer)
Reporter abuse_ch
Tags:exe Stealc


Avatar
abuse_ch
Stealc C2:
http://193.58.121.25/8b0d6900a357439d.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://193.58.121.25/8b0d6900a357439d.php https://threatfox.abuse.ch/ioc/1744504/

Intelligence

File Origin
# of uploads :
2
# of downloads :
214
Origin country :
NL NL
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9deb4c5b-8def-4b6a-8143-fae415e1a566/
Malware family:
n/a
ID:
1
File name:
SLAXAFDN.exe
Verdict:
No threats detected
Analysis date:
2026-02-10 21:18:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d09643d7-f3bc-47c8-afbf-a589394bed4e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/52974/
Detection(s):
SecuriteInfo.com.Trojan.Inject6.26113.28210.28484.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698c2ba5d255592b7e32d710
Tags:
injection dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
DNS request
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
embarcadero_delphi fingerprint inno installer installer installer-heuristic packed soft-404
Link:
https://www.filescan.io/uploads/698c2ee4981ff1d38a510fb0/reports/c133ca68-8a98-439d-93de-379e1d0a9c94/overview
Verdict:
Malicious
Labled as:
Win32_TrojanDownloader_Rugmi_BUV_trojan
Link:
https://www.hybrid-analysis.com/sample/b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-10T19:21:00Z UTC
Last seen:
2026-02-11T00:29:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Delf.sb Trojan.Win32.Penguish.gom Trojan.Win32.Strab.sb Trojan.Win32.Penguish.sb
Link:
https://opentip.kaspersky.com/b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/f59d6348-d5c8-4f5b-82ea-87fb540df3dc
Result
Threat name:
HijackLoader, Stealc v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1867216
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Early bird code injection technique detected
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected HijackLoader
Yara detected Stealc v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1867216 Sample: b4e4178aea8498d952fec581ab3... Startdate: 11/02/2026 Architecture: WINDOWS Score: 100 66 Suricata IDS alerts for network traffic 2->66 68 Found malware configuration 2->68 70 Antivirus detection for URL or domain 2->70 72 6 other signatures 2->72 10 b4e4178aea8498d952fec581ab3367c05a6272c444fac.exe 2 2->10         started        process3 file4 50 b4e4178aea8498d952...c05a6272c444fac.tmp, PE32 10->50 dropped 13 b4e4178aea8498d952fec581ab3367c05a6272c444fac.tmp 3 19 10->13         started        process5 file6 52 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 13->52 dropped 54 C:\Users\user\AppData\...\VCRUNTIME140.dll, PE32 13->54 dropped 56 C:\Users\user\AppData\Local\...\MSVCP140.dll, PE32 13->56 dropped 58 3 other malicious files 13->58 dropped 16 FactoryMatrix16.exe 10 13->16         started        process7 file8 36 C:\ProgramData\...\VCRUNTIME140.dll, PE32 16->36 dropped 38 C:\ProgramData\...\MSVCP140.dll, PE32 16->38 dropped 40 C:\ProgramData\...\KernelTraceControl.dll, PE32 16->40 dropped 42 2 other malicious files 16->42 dropped 62 Switches to a custom stack to bypass stack traces 16->62 64 Found direct / indirect Syscall (likely to bypass EDR) 16->64 20 FactoryMatrix16.exe 7 16->20         started        signatures9 process10 file11 44 C:\Users\user\AppData\Roaming\...\Crisp.exe, PE32 20->44 dropped 46 C:\Users\user\AppData\...\PhotonGenera.exe, PE32+ 20->46 dropped 48 C:\Users\user\AppData\Local\Temp\B7F2CA.tmp, PE32+ 20->48 dropped 74 Modifies the context of a thread in another process (thread injection) 20->74 76 Found hidden mapped module (file has been removed from disk) 20->76 78 Maps a DLL or memory area into another process 20->78 80 2 other signatures 20->80 24 PhotonGenera.exe 12 20->24         started        28 Crisp.exe 20->28         started        signatures12 process13 dnsIp14 60 193.58.121.25, 49698, 80 DCHASSELTBE Germany 24->60 82 Early bird code injection technique detected 24->82 84 Found many strings related to Crypto-Wallets (likely being stolen) 24->84 86 Writes to foreign memory regions 24->86 94 3 other signatures 24->94 30 chrome.exe 24->30         started        32 chrome.exe 24->32         started        34 chrome.exe 24->34         started        88 Unusual module load detection (module proxying) 28->88 90 Switches to a custom stack to bypass stack traces 28->90 92 Found direct / indirect Syscall (likely to bypass EDR) 28->92 signatures15 process16
Score:
32%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/e50eae63c7f97441772f8bffe1ca7112
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f/
Verdict:
Malicious
Threat:
Family.HIJACKLOADER
Link:
https://tip.neiki.dev/file/b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f
Threat name:
Win32.Trojan.Rugmi
Create hunting rule
Status:
Malicious
First seen:
2026-02-11 01:50:36 UTC
File Type:
PE (Exe)
Extracted files:
65
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtsbpcxkqsmnsux6ywa2wm3hybnge4weit5mjbkdow7xckkgwbpq._file
Verdict:
malicious
Label(s):
hijackloader
Create hunting rule
stealc
Create hunting rule
Similar samples:
error
Stealc
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader family:stealc botnet:1 discovery installer loader stealer
Link:
https://tria.ge/reports/260211-h85g3sbz9f/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Detects HijackLoader (aka IDAT Loader)
HijackLoader, IDAT loader, Ghostulse,
Hijackloader family
Stealc
Stealc family
Malware Config
C2 Extraction:
http://193.58.121.25
Unpacked files
SH256 hash:
b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f
MD5 hash:
e50eae63c7f97441772f8bffe1ca7112
SHA1 hash:
72214c2b44dcb92dcd429bedcfd743ffdab9edea
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
1c03da278db8ff1591cff5c42019c2e179b825f81bbe9b6954e07aa3c6d4f448
MD5 hash:
db6e29a115eeee0a070035f758a63a33
SHA1 hash:
a2a05d08f72c4e32144466bac12d7e3117106d50
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
be8e9f68c5f9213e1a8240cefef2218b0f51a955eb8d4c69cae8814a194cc83e
MD5 hash:
b11ff268cb328dc700fb14a9198d0bb2
SHA1 hash:
bc3c8efba673058f508978bffdf6a7894acec9b1
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
03511b84523bc392d953cd3a733fbdf6b0398b00166621e39ecc9fd99d6eedfb
MD5 hash:
b726d26107ec8d1da252d74fa1d8ccbf
SHA1 hash:
cbca57db51d419ce22f36771f2ccb75e231484a4
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
835b1d9ea67c34ad55e8a90585a96b6780d977c41c218e8ee921757c2639f51a
MD5 hash:
dd21f7cdd6adc6031970425bc8bf1c07
SHA1 hash:
d039e06737e2cc9173a7130f8ef9e5d2d740ba18
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
8f0beb5863d190b7b2cfe7f506f3b721ab6b9e892337a133364f2ba710931b25
MD5 hash:
be3cc5717f5951662adb399d613f20cc
SHA1 hash:
f776bc4344ad59fbd6950d24d3aa6dddb3df215a
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
ee892ad4785b48ec4245e645df10c5e1152c1169173e9108157a05c568b388bd
MD5 hash:
5a6290f1affb97875d4d4727439f8a53
SHA1 hash:
d0b854b70f0ea7411a63a2379efc770c24728d43
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
08a93ad91061aeda02121ae6a4fc9ec024f612e39626c615fd5f3765957608a4
MD5 hash:
2e259afb699d02eecfa0817e791e3324
SHA1 hash:
3873b36b6b1257dfa6543124383e932d553126a4
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0
MD5 hash:
cabb58bb5694f8b8269a73172c85b717
SHA1 hash:
9ed583c56385fed8e5e0757ddb2fdf025f96c807
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
SH256 hash:
68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe
MD5 hash:
d4dae7149d6e4dab65ac554e55868e3b
SHA1 hash:
b3bea0a0a1f0a6f251bcf6a730a97acc933f269a
Link:
https://www.unpac.me/results/3c1d135d-7e52-4d44-a80f-d7034b75db32/
Malware family:
HijackLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b4e4178aea84/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b4e4178aea8498d952fec581ab3367c05a6272c444fac4854375bf712946b05f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/52974/

Comments