MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6
SHA3-384 hash: f8a11b7ef064a61795c63fc6c328cc7ccdb4077c2ab8a8f1463f470ab16fa3576e16044aaa10ec3835c6148ff07c596d
SHA1 hash: 451b18adecec04dd954b49abaa32017d52014d79
MD5 hash: 74d3c838340187a3eb0a872d2e57a70d
humanhash: kentucky-november-illinois-high
File name:74d3c838340187a3eb0a872d2e57a70d.exe
Download: download sample
File size:821'760 bytes
First seen:2025-10-20 13:50:34 UTC
Last seen:2025-10-20 15:19:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 343a491230dea19c54cbc3c18d20c5b9
ssdeep 12288:TYN9JPse55YqbZrZ6Rp2ePIDYW91qvdtkd4nOl6leWB89aB1:TYN9JzVbBZ0SY3dtkd4Ol6DB89
TLSH T1DB058D47F3A940E8D0AAC274C7569227FBB2B84A2230BB5B57E04B563F53E706B1D315
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
74d3c838340187a3eb0a872d2e57a70d.exe
Verdict:
Malicious activity
Analysis date:
2025-10-20 13:51:05 UTC
Tags:
discord stealer
Link:
https://app.any.run/tasks/cb1f2a03-e3e6-4d50-8ace-1788d0450f63

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/33464/
Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f63e696dc4a08515e38167
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context crypto expand hacktool lolbin microsoft_visual_cc obfuscated stealer
Link:
https://www.filescan.io/uploads/68f63e4c11ff3db29f6476a8/reports/ef320ece-e81e-4759-bb11-9c0fa9929ec9/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6
Verdict:
Clean
File Type:
exe x64
First seen:
2025-10-16T13:54:00Z UTC
Last seen:
2025-10-21T10:18:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/7eeadf3a-a679-4912-8cd6-e7106ead9b52
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1798402
Signature
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/74d3c838340187a3eb0a872d2e57a70d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6/
Verdict:
Malicious
Threat:
Win64.Infostealer.ShadowSniff
Link:
https://tip.neiki.dev/file/bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6
Threat name:
Win64.Trojan.Etset
Create hunting rule
Status:
Malicious
First seen:
2025-10-16 16:20:16 UTC
File Type:
PE+ (Exe)
AV detection:
23 of 37 (62.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3mfanpf4yehryamgwm35b6ifz2ufgehe3oahmynajw43phqpdda._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/251020-q5xbasgz2b/
Behaviour
Gathers system information
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Browser Information Discovery
Legitimate hosting services abused for malware hosting/C2
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6
MD5 hash:
74d3c838340187a3eb0a872d2e57a70d
SHA1 hash:
451b18adecec04dd954b49abaa32017d52014d79
Link:
https://www.unpac.me/results/56e26de4-ba2a-4c9d-916e-9938321a1ba1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bed85035e5e6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe bed85035e5e60878e00c3599be87c82e7542988726dc03b30d026dcdbcf078c6

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/33464/
  
URLhaus
https://urlhaus.abuse.ch/url/3682303/
  
Delivery method
Distributed via web download

Comments