MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d99796073dfaed40d0dc92868d43a93e1ea0ea0cf81074b30b7d80c00cc3b15e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureHVNC

Vendor detections: 12

Intelligence 12 IOCs YARA 7 File information Comments

SHA256 hash:	d99796073dfaed40d0dc92868d43a93e1ea0ea0cf81074b30b7d80c00cc3b15e
SHA3-384 hash:	08cc9125cd22fef16abd5fc25ecc3b1d4364e33ba27fcc33a6232d0f5227c0cd70339ef6cd0f02f2ff584b8c313dfc70
SHA1 hash:	be3f10fe6278e584a9b159e2a0502f4c68be85df
MD5 hash:	6872f1ef296dd0836c71a3b20afe503d
humanhash:	quebec-failed-lemon-black
File name:	SecuriteInfo.com.Trojan.Mardom.IN.10.38167571
Download:	download sample
Signature	PureHVNC Create hunting rule
File size:	784'384 bytes
First seen:	2026-06-10 09:42:17 UTC
Last seen:	2026-06-10 10:37:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'017 x Formbook, 12'352 x SnakeKeylogger)
ssdeep	12288:juZ9WtH7w60GhlhJEr8NQNG7QQhqhDr7Od0Os9ZSN1wXGaQY+p:SHWBwHyhJErwIQkhDr+o9wMc
Threatray	134 similar samples on MalwareBazaar
TLSH	T132F4BE1B76A68E21D2C41236C1E7141197F49587BA37E70E798423DB29023FBEE4B397
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe PureHVNC

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NETReactor

Details

Link:

https://research.acce.ciphertechsolutions.com/results/0a13e5c9-c165-49da-8395-ced1da868384/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-06-10 10:02:17 UTC

Tags:

netreactor stealer

Link:

https://app.any.run/tasks/37600028-fce1-47de-ae4e-21080e0ee56b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/70452/

Detection(s):

SecuriteInfo.com.Trojan.Mardom.IN.10.38167571.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a29319ca15110463ee46e30

Tags:

malware

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Connection attempt

Сreating synchronization primitives

Connection attempt to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 net_reactor obfuscated obfuscated packed packed

Link:

https://www.filescan.io/uploads/6a293193bf16337e43bfa6c6/reports/0a754a85-c18c-45b8-917a-061438a36325/overview

Verdict:

Malicious

Labled as:

Trojan.Mardom.IN.Generic

Link:

https://www.hybrid-analysis.com/sample/d99796073dfaed40d0dc92868d43a93e1ea0ea0cf81074b30b7d80c00cc3b15e

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/05474fd2-2155-47d6-b022-6cba6328411c

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d99796073dfaed40d0dc92868d43a93e1ea0ea0cf81074b30b7d80c00cc3b15e

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d99796073dfaed40d0dc92868d43a93e1ea0ea0cf81074b30b7d80c00cc3b15e/

Threat name:

Win32.Trojan.Kepavll

Status:

Malicious

First seen:

2026-06-10 09:44:30 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3glzmbz57lwubug4skdi2q5jhypkb2qm7aihjmylpwamadgdwfpa._file

Verdict:

malicious

Label(s):

purecrypter

PureHVNC

8918151f86687bf6dcd6962b05fe94d4a48c400d89cfdee172d8ee70f06c3403

PureHVNC

9c6e7d595b4baef4e6dc1237ecff473eebb6f386811557f2232bd3e52289f625

PureHVNC

9e1aa478a7edfc6b9ae520955abcd2faa6bd3937fa083bca242ec237ba360e91

PureHVNC

afb5b88d2bdfc62c7203bb195438b383d85ca24586f9ccf183f0ef6c032f4280

PureHVNC

d99796073dfaed40d0dc92868d43a93e1ea0ea0cf81074b30b7d80c00cc3b15e

PureHVNC

error

PureHVNC

+ 124 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

collection discovery spyware stealer

Link:

https://tria.ge/reports/260610-lpt4sagt91/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

d99796073dfaed40d0dc92868d43a93e1ea0ea0cf81074b30b7d80c00cc3b15e

MD5 hash:

6872f1ef296dd0836c71a3b20afe503d

SHA1 hash:

be3f10fe6278e584a9b159e2a0502f4c68be85df

Link:

https://www.unpac.me/results/5dec6cea-7ec7-4485-90eb-a21e285d7bb8/

SH256 hash:

00a41662646bd38c0bd415e6b41d4d9c23d397d8b2311e28328e2e1f9e9c063f

MD5 hash:

3c3a3e5097bdf3e35534867f3c440b30

SHA1 hash:

31c643f5a3dadc382c8a163c943d35077f6202b3

Link:

https://www.unpac.me/results/5dec6cea-7ec7-4485-90eb-a21e285d7bb8/

SH256 hash:

b2a66e9864f81c2800a5afef4bfd1faf7c910e5a43ea2eb9dbb15c8ab6ffc633

MD5 hash:

f0a13fb422cdb1f3ce667df897b5045b

SHA1 hash:

9b6566603e3a292482788924a83a1d94a9cd4627

Link:

https://www.unpac.me/results/5dec6cea-7ec7-4485-90eb-a21e285d7bb8/

SH256 hash:

3f65fe1b2ae640aa414e2727576b38a0b055e191a0cbc3bd55b84cc38e50b8ba

MD5 hash:

d1991d3694ef7cd89f4554579d177c32

SHA1 hash:

d3a60e864b62923c2c50aec47e0ff8c1e2fc2dc9

Link:

https://www.unpac.me/results/5dec6cea-7ec7-4485-90eb-a21e285d7bb8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d99796073dfaed40d0dc92868d43a93e1ea0ea0cf81074b30b7d80c00cc3b15e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.