🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3
SHA3-384 hash: 526aed3b3fc9d272b51fef1bc54298cdecb881aa776d27cd8ccb7f2818c12941c9ce413fe1cffc526ef56b896d19e016
SHA1 hash: f1e2dcbb4db650f85a75ad5788c065a16991a9c3
MD5 hash: 2a72111dd3af89f084651e0e05de3b60
humanhash: lactose-indigo-equal-ten
File name:crypted.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:1'537'536 bytes
First seen:2026-04-15 12:37:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 248f0bf5e1606ed05edfc57eab89251b (1 x Stealc)
ssdeep 24576:GcVZYKJZ6toiXm1HpbVcDyLXXGNRFBbVJdGik32KTXz1IfZaAP48zenjFxVjv+e1:GcVZ
Threatray 5 similar samples on MalwareBazaar
TLSH T19665B0B8B5042DE6E96F463FCA97ADE9137236628B97D4CF406467C309633B1DF22805
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 8274f0b484b4d4a4 (2 x Stealc, 1 x CoinMiner)
Reporter burger
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
xmrig
Create hunting rule
ID:
1
File name:
crypted.exe
Verdict:
Malicious activity
Analysis date:
2026-04-15 09:41:26 UTC
Tags:
stealer stealc rust github telegram auto-sch-xml evasion loader xmrig amsi-bypass
Link:
https://app.any.run/tasks/bc8de1dc-02bb-4554-965e-5de5a401bf02

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61743/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69df867bf68adfe1003a1041
Tags:
bitcoin cobalt crypt hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Сreating synchronization primitives
DNS request
Sending an HTTP POST request to an infection source
Connection attempt to an infection source
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-04-15T10:09:00Z UTC
Last seen:
2026-04-16T06:41:00Z UTC
Hits:
~10
Detections:
Trojan-PSW.Win64.StealC.sb Trojan-PSW.Win64.StealC.oe Trojan-PSW.StealC.HTTP.C&C
Link:
https://opentip.kaspersky.com/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ad18a5d0-500c-4f40-a082-4ea85752a471
Result
Threat name:
Stealc v2, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1898714
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Disables Windows Defender (via service or powershell)
Early bird code injection technique detected
Found API chain indicative of debugger detection
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Modifies Windows Defender protection settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Queues an APC in another process (thread injection)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected PersistenceViaHiddenTask
Yara detected Stealc v2
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1898714 Sample: crypted.exe Startdate: 15/04/2026 Architecture: WINDOWS Score: 100 89 api.telegram.org 2->89 91 raw.githubusercontent.com 2->91 93 3 other IPs or domains 2->93 101 Suricata IDS alerts for network traffic 2->101 103 Found malware configuration 2->103 105 Multi AV Scanner detection for dropped file 2->105 109 9 other signatures 2->109 10 crypted.exe 1 2->10         started        13 cQMznPBHY7rk.exe 2->13         started        16 cQMznPBHY7rk.exe 2->16         started        18 2 other processes 2->18 signatures3 107 Uses the Telegram API (likely for C&C communication) 89->107 process4 file5 81 C:\Users\user\AppData\...\b1c179fd07df.exe, PE32+ 10->81 dropped 20 b1c179fd07df.exe 22 10->20         started        131 Multi AV Scanner detection for dropped file 13->131 25 conhost.exe 13->25         started        27 conhost.exe 16->27         started        29 conhost.exe 18->29         started        31 conhost.exe 18->31         started        signatures6 process7 dnsIp8 95 95.85.238.4, 49693, 49700, 49701 METRONETCZ Czech Republic 20->95 97 github.com 140.82.112.3, 443, 49702 GITHUBUS United States 20->97 99 raw.githubusercontent.com 185.199.108.133, 443, 49703 FASTLYUS Netherlands 20->99 77 C:\Users\user\AppData\...\cQMznPBHY7rk.exe, PE32+ 20->77 dropped 79 C:\Users\user\AppData\...\payload[1].exe, PE32+ 20->79 dropped 119 Multi AV Scanner detection for dropped file 20->119 121 Early bird code injection technique detected 20->121 123 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->123 125 10 other signatures 20->125 33 cQMznPBHY7rk.exe 1 9 20->33         started        38 msedge.exe 20->38         started        40 msedge.exe 20->40         started        42 2 other processes 20->42 file9 signatures10 process11 dnsIp12 83 77.91.97.172, 49707, 49708, 80 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU Russian Federation 33->83 85 ip-api.com 208.95.112.1, 49704, 80 TUT-ASUS United States 33->85 87 2 other IPs or domains 33->87 71 C:\Users\user\AppData\...\cQMznPBHY7rk.exe, PE32+ 33->71 dropped 73 C:\Users\user\AppData\...\certutil.dat, PE32+ 33->73 dropped 75 WindowsSecurityHealthServiceMonitor.xml, XML 33->75 dropped 111 Multi AV Scanner detection for dropped file 33->111 113 Suspicious powershell command line found 33->113 115 Found strings related to Crypto-Mining 33->115 117 5 other signatures 33->117 44 cmd.exe 33->44         started        47 cmd.exe 33->47         started        49 cmd.exe 33->49         started        51 28 other processes 33->51 file13 signatures14 process15 signatures16 127 Uses cmd line tools excessively to alter registry or file data 44->127 53 conhost.exe 44->53         started        55 reg.exe 44->55         started        57 conhost.exe 47->57         started        59 reg.exe 47->59         started        61 conhost.exe 49->61         started        63 reg.exe 49->63         started        129 Loading BitLocker PowerShell Module 51->129 65 conhost.exe 51->65         started        67 conhost.exe 51->67         started        69 37 other processes 51->69 process17
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3
Threat name:
Win64.Spyware.Stealc
Create hunting rule
Status:
Malicious
First seen:
2026-04-15 12:37:24 UTC
File Type:
PE+ (Exe)
Extracted files:
15
AV detection:
11 of 24 (45.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ti7i3xa3swhxmckynujvbod5gx2juq7bolkdou4ue4di5tqh3jq._file
Verdict:
malicious
Label(s):
shellcode_loader_007
Create hunting rule
stealc
Create hunting rule
Similar samples:
349dab2f8a35fe80468fa12d155aeddb9f81ae2b94541123e17e56b00e5e1df9
Stealc
9a7c87d58a7ab1f2d99c5390d04c3875e41587b46f0632518e6108286ca45e2c
Stealc
d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3
Stealc
error
Stealc
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:525252 discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260415-ptx8saet9m/
Behaviour
Checks processor information in registry
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Contacts third-party web service commonly abused for C2
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Detects Stealc stealer Version 2
Family: Stealc
Malware Config
C2 Extraction:
http://95.85.238.4
Unpacked files
SH256 hash:
d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3
MD5 hash:
2a72111dd3af89f084651e0e05de3b60
SHA1 hash:
f1e2dcbb4db650f85a75ad5788c065a16991a9c3
Link:
https://www.unpac.me/results/79a6343b-ec42-4379-8e56-d3be8bf363b7/
Malware family:
Stealc.v2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d4d1f46ee0dc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/61743/

Comments