MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Scavenger


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134
SHA3-384 hash: cf0f9e749da533913c2d641ae956f1c48fd7ff3e6a06d4e0925da9d9b9a2f3fd146f803bb9dfaf7d5c8701581a47d6fb
SHA1 hash: 60fca6ad18c8574f5234fdd47963d6fb9a6e113e
MD5 hash: 19acc6fc9bfb0bb1bfb6179fc37ff5b0
humanhash: hawaii-quebec-washington-mirror
File name:c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134
Download: download sample
Signature Scavenger
Create hunting rule
File size:72'192 bytes
First seen:2025-07-19 22:20:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3079a432e680790a643ce9503fc3bb76 (1 x Scavenger)
ssdeep 768:3Ha1XYbBWnr/HzznDrg4xIIGvgfv80/g7SigwmuwQN+XnACAmDFvsLbnIFAgWJEE:G58BCSGJAKwmWr88a7f2/yT9JkoZcb
TLSH T10963644AD2FE15ADD5FA803C494BA772FB20306D522077AF96D8478627506B8AF7C343
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter johnk3r
Tags:exe npm Scavenger SupplyChain

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134
Verdict:
Suspicious activity
Analysis date:
2025-07-19 22:25:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/19202924-b878-4814-a8b9-5628e8ac2d0f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15863/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=687c1a612f623871a5f04ab1
Tags:
stealer dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 microsoft_visual_cc
Link:
https://www.filescan.io/uploads/687c1a5f07c0e888a96d5e9a/reports/95860093-1237-4058-9981-8dc09fac023b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d17298b4-ea87-4458-997a-4a8f18bfdd5b
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1740227
Signature
Found direct / indirect Syscall (likely to bypass EDR)
Hides threads from debuggers
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sigma detected: Curl Download And Execute Combination
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1740227 Sample: 4842JCg9i7.exe Startdate: 20/07/2025 Architecture: WINDOWS Score: 64 34 ac7b2eda6f14.datahog.su 2->34 40 Multi AV Scanner detection for submitted file 2->40 42 Sigma detected: Curl Download And Execute Combination 2->42 10 loaddll64.exe 1 2->10         started        signatures3 process4 signatures5 46 Query firmware table information (likely to detect VMs) 10->46 48 Hides threads from debuggers 10->48 50 Found direct / indirect Syscall (likely to bypass EDR) 10->50 13 cmd.exe 1 10->13         started        15 cmd.exe 1 10->15         started        17 conhost.exe 10->17         started        process6 process7 19 rundll32.exe 13->19         started        22 curl.exe 2 15->22         started        dnsIp8 44 Hides threads from debuggers 19->44 25 cmd.exe 19->25         started        36 127.0.0.1 unknown unknown 22->36 signatures9 process10 process11 27 curl.exe 1 25->27         started        30 conhost.exe 25->30         started        32 rundll32.exe 25->32         started        dnsIp12 38 ac7b2eda6f14.datahog.su 104.21.16.1, 443, 49688, 49689 CLOUDFLARENETUS United States 27->38
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/19acc6fc9bfb0bb1bfb6179fc37ff5b0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134/
Verdict:
Malicious
Threat:
Trojan-PSW.Win32.Pycoon.sb
Link:
https://tip.neiki.dev/file/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134
Threat name:
Win64.Infostealer.Scavenger
Create hunting rule
Status:
Malicious
First seen:
2025-04-24 23:30:31 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
12 of 22 (54.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ynjww43me3gvizgg6u6oqnb5h7sub23jtk6ql5ew3tj3rnd4ke2a._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/250719-19stsasyby/
Behaviour
Suspicious use of NtSetInformationThreadHideFromDebugger
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0d6257f3-3f86-472d-809e-1f279c087cd2
Unpacked files
SH256 hash:
c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134
MD5 hash:
19acc6fc9bfb0bb1bfb6179fc37ff5b0
SHA1 hash:
60fca6ad18c8574f5234fdd47963d6fb9a6e113e
Link:
https://www.unpac.me/results/6168c8ac-9cc7-4e4e-8a54-cd25bd3b6068/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3536b736c26cd5464c6f53ce8343d3fe540eb699abd05f496dcd3b8b47c5134

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://x.com/MalwareUtkonos/status/1946591976247218355
Cape
Cape
https://www.capesandbox.com/analysis/15863/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::GetTempPathA

Comments