MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba7c8843fe81a98136fbdcd04069698305a82d4ccef32fbe87a78ffb30ddd04a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RevStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments

SHA256 hash:	ba7c8843fe81a98136fbdcd04069698305a82d4ccef32fbe87a78ffb30ddd04a
SHA3-384 hash:	9590a96c9f9e7d363ec95a467137783f29eff44ced6d35bf3eff9c4e94b96a882a5f41fdbec4500df2e077466ba34e86
SHA1 hash:	c3f5eebd8df1185937650fda628d3f02234f5fbb
MD5 hash:	38a93256b43b63d63a34b815e2bbaf81
humanhash:	harry-alanine-hydrogen-cat
File name:	ba7c8843fe81a98136fbdcd04069698305a82d4ccef32fbe87a78ffb30ddd04a
Download:	download sample
Signature	RevStealer Create hunting rule
File size:	2'923'008 bytes
First seen:	2026-11-06 14:56:33 UTC
Last seen:	2026-11-06 15:28:56 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	a6696f6a922ae4f043762842d701e341 (107 x RevStealer)
ssdeep	49152:8ZBsxfglnQbDK+iKUNdh9NT0qFoa6q4pOCYXO/jdumorHggkqDou13KOEadL:VCNQvjeNx7spbMmo3ou0HW
TLSH	T177D523A5B8F6AEB5C877C3B28F02E06EB02A739A5B344D07B6CD9C114D536506D363B1
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	adrian__luca
Tags:	exe RevStealer

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/52362b22-cfd8-43e6-94d5-68d582042bd8/

Malware family:

phorpiex

ID:

File name:

2to1ep.exe

Verdict:

Malicious activity

Analysis date:

2026-10-04 05:34:01 UTC

Tags:

auto metasploit framework arch-exec evasion phorpiex botnet opendir python solaris loader github stealer stealc nemucod possible-phishing generic powershell screenconnect rdp rmm-tool dsys rat dcagentrmm svc telegram pastebin silentnet tool remote xmrig miner arcticagent asyncrat remusstealer clickfix phishing tinynuke action1rmm guloader koiloader vidar cryptowall ransomware gh0st rhadamanthys bruteratel redline meterpreter coinminer stealerium ip-check networm amus pyinstaller putty susp-powershell smb wannacry havoc gcleaner pushware adware rustystealer amadey scan smbscan infinitycrypt xworm onyxc2 lumma acr cryptolocker whitesnakestealer cobaltstrike datto noescape wiper njrat bladabindi websocket glamour reversessh delphi autoit donutloader troldesh shade dharma openssl netsupport quasar teamviewer tor blackmoon banker jigsaw advancedinstaller salatstealer abyssos jeefo ramnit santastealer destinystealer whitesnake action1

Link:

https://app.any.run/tasks/fabbce69-a1a5-4182-aae4-ada7123652bb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/97767/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af1b98cac89c90fc65a46ec

Tags:

vmprotect injection virus remo

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating synchronization primitives

Creating a file

Creating a process from a recently created file

Creating a process with a hidden window

Connection attempt to an infection source

DNS request

Connection attempt

Sending an HTTP GET request

Launching a service

Query of malicious DNS domain

Sending a TCP request to an infection source

Enabling autorun

Deleting of the original file

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/ba7c8843fe81a98136fbdcd04069698305a82d4ccef32fbe87a78ffb30ddd04a

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-04T04:18:00Z UTC

Last seen:

2026-10-05T02:26:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ba7c8843fe81a98136fbdcd04069698305a82d4ccef32fbe87a78ffb30ddd04a/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/c3af7644-78d1-4a31-8e27-b78a9a4fd004

Result

Threat name:

RevStealer

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1999898

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Creates / moves files in alternative data streams (ADS)

Creates an undocumented autostart registry key

Deletes itself after installation

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Yara detected RevStealer

Behaviour

Behavior Graph:

Download SVG

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/38a93256b43b63d63a34b815e2bbaf81

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ba7c8843fe81a98136fbdcd04069698305a82d4ccef32fbe87a78ffb30ddd04a/

Threat name:

Win64.Trojan.Pmax

Status:

Suspicious

First seen:

2026-10-04 15:55:46 UTC

File Type:

PE+ (Exe)

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xj6iqq76qguycnx33tiea2ljqmc2qlkmz3zs7puhu6h7wmg52bfa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery persistence

Link:

https://tria.ge/reports/261106-sbs3wscs9s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Reads the TCP/IP host and domain name from the registry

Deletes itself

Executes dropped EXE

Registers new Windows logon scripts automatically executed at logon.

Malware Family:

n/a

Verdict:

Suspicious

Tags:

loader

YARA:

n/a

Link:

https://app.threat.zone/submission/20b9e187-d230-4c98-b365-857f6d32a0e8

Malware Family:

exeheaderl

Malicious:

True

Tags:

64bits spreader

Link:

https://intel.virussign.com/intelligence/file/ba7c8843fe81a98136fbdcd04069698305a82d4ccef32fbe87a78ffb30ddd04a

Unpacked files

SH256 hash:

ba7c8843fe81a98136fbdcd04069698305a82d4ccef32fbe87a78ffb30ddd04a

MD5 hash:

38a93256b43b63d63a34b815e2bbaf81

SHA1 hash:

c3f5eebd8df1185937650fda628d3f02234f5fbb

Link:

https://www.unpac.me/results/cc082d7b-5ec7-4244-9385-ec94b6c1afc7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ba7c8843fe81a98136fbdcd04069698305a82d4ccef32fbe87a78ffb30ddd04a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.