MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SantaStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a
SHA3-384 hash: 834330b2d6ac85458e10d3dfe47e7403efbe8526fa81264067dcb7f2ac454acdf3d15c86d90210081184e806194d1bff
SHA1 hash: 62f08ff89fd824dcde987d8463b192c8e416a8bd
MD5 hash: 8ebc92a0790f981de13147e4872e3d95
humanhash: finch-paris-montana-thirteen
File name:Cortana.dll
Download: download sample
Signature SantaStealer
Create hunting rule
File size:469'504 bytes
First seen:2026-02-13 14:03:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2d3722789241a78d62128955367c756e (1 x SantaStealer)
ssdeep 6144:uEytwADnyoE4hyWeXVmq0+cBBs2kk9jM4UTwXi3ZGgDAijJDpK76vl6IUN7vSg:uEAs4hy6qxcTvkk9cT35jWol6i
TLSH T183A49E07735317F9C76B827891E6A7B1B431F4180725AE7F0A98DB322F64DA1066FE24
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Ling
Tags:Egairtigado exe SantaStealer Shellcode Trojan:Win32/Egairtigado!rfn


Avatar
CNGaoLing
This sample has been analyzed and classified as malware by Huorong, a leading Chinese cybersecurity firm. For further technical details, please refer to their official report: https://www.huorong.cn/document/tech/vir_report/1923

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
Flash.zip
Verdict:
Malicious activity
Analysis date:
2026-02-12 13:18:41 UTC
Tags:
arch-exec donutloader loader valleyrat rat silverfox winos
Link:
https://app.any.run/tasks/af347f76-736c-490c-a928-c1c808883a83

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53269/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698da3e52afa47e5c6463ffa
Tags:
dropper virus
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a
Verdict:
Malicious
File Type:
dll x64
First seen:
2026-01-13T02:52:00Z UTC
Last seen:
2026-02-13T13:33:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Shellcode.sb PDM:Trojan.Win32.Generic Trojan.Win32.Shellcode.kwp HEUR:Backdoor.Win32.Farfli.gen
Link:
https://opentip.kaspersky.com/bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a/results?tab=lookup
Malware family:
Santastealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6a04a0f6-3714-4d20-aba3-2b08690a911b
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/8ebc92a0790f981de13147e4872e3d95
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-02-12 09:56:54 UTC
File Type:
PE+ (Dll)
AV detection:
13 of 38 (34.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmsf5bsz24njmqwfks5kpbbhygm5omwxeqh4duzwm2gwehii72fa._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
valleyrat
Create hunting rule
Similar samples:
error
SantaStealer
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/260213-rcscbabw4h/
Behaviour
Adds Run key to start application
Unpacked files
SH256 hash:
bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a
MD5 hash:
8ebc92a0790f981de13147e4872e3d95
SHA1 hash:
62f08ff89fd824dcde987d8463b192c8e416a8bd
Link:
https://www.unpac.me/results/f5acd48e-7675-4752-ba8e-2a13c979269e/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bb245e8659d7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SantaStealer

Executable exe bb245e8659d71a9642c554baa78427c199d732d7240fc1d336668d621d08fe8a

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/53269/

Comments