🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db4b6c524cbbdb661779fbc66a2f4c7369df8babc733ef965b279542477b2aca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db4b6c524cbbdb661779fbc66a2f4c7369df8babc733ef965b279542477b2aca
SHA3-384 hash: 762819cd11c1e66f598cce8cf8bd2c155565ea499c447c4e649b56de21030a2346d08c089dfc1f214ef1c9089ae5e6dc
SHA1 hash: edfe8c5b6e6f5c183274ba3fe584883ab28fc82d
MD5 hash: 0e8117413e01170023089c95fd91dc6f
humanhash: two-cold-bulldog-lemon
File name:0e8117413e01170023089c95fd91dc6f.exe
Download: download sample
Signature PureRAT
Create hunting rule
File size:1'448'018 bytes
First seen:2026-09-20 06:34:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'246 x AgentTesla, 20'509 x Formbook, 12'377 x SnakeKeylogger)
ssdeep 24576:NLfpCuNZ1otmVtFTiMkWTZ38JhglcmIZjQnUMKyHdtqD9+0iC4VioMdcD:NzJTFV6W12XDjQbKEo5iC4V5D
TLSH T16B6533AC67E61B87C2758EB0944253541386A3FAB804FFAB7DC50525C75B38C2541BBF
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe PureRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
SE SE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a305fbb6-3d9c-4071-bdb3-46a2c28ebca3/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-20 06:40:28 UTC
Tags:
auto-startup rat purehvnc stealer netreactor zgrat
Link:
https://app.any.run/tasks/e574a6bc-e2af-4a15-98a2-98c0c336c2a3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/87474/
Detection(s):
SecuriteInfo.com.Trojan.Inject6.2811.15851.4202.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Launching a process
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending a custom TCP request
Creating a window
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 obfuscated overlay packed packed
Link:
https://www.filescan.io/uploads/6aaf7eae8bde4a724e41fb88/reports/765e1182-27af-40f0-9b3b-0bdcb48bdd3a/overview
Verdict:
Malicious
Labled as:
Trojan.Mardom.MN.Generic
Link:
https://www.hybrid-analysis.com/sample/db4b6c524cbbdb661779fbc66a2f4c7369df8babc733ef965b279542477b2aca
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-16T10:37:00Z UTC
Last seen:
2026-09-19T14:03:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/db4b6c524cbbdb661779fbc66a2f4c7369df8babc733ef965b279542477b2aca/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0b8b1b6b-e8e1-4e1a-a83b-464d46bbad65
Result
Threat name:
ResolverRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1975276
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops VBS files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Drops script at startup location
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected MSIL Injector
Yara detected ResolverRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1975276 Sample: 41sNMWQXYO.exe Startdate: 20/09/2026 Architecture: WINDOWS Score: 100 28 pure8s.ddnsfree.com 2->28 30 pki-goog.l.google.com 2->30 32 3 other IPs or domains 2->32 36 Suricata IDS alerts for network traffic 2->36 38 Antivirus / Scanner detection for submitted sample 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 9 other signatures 2->42 8 41sNMWQXYO.exe 5 2->8         started        12 wscript.exe 1 2->12         started        signatures3 process4 file5 22 C:\Users\user\AppData\Roaming22ame.exe, PE32 8->22 dropped 24 C:\Users\user\...24ame.exe:Zone.Identifier, ASCII 8->24 dropped 26 C:\Users\user\AppData\Roaming\...26ame.vbs, ASCII 8->26 dropped 44 Found many strings related to Crypto-Wallets (likely being stolen) 8->44 46 Drops VBS files to the startup folder 8->46 48 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->48 54 2 other signatures 8->54 14 MSBuild.exe 3 2 8->14         started        50 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->50 52 WScript reads language and country specific registry keys (likely country aware script) 12->52 18 Name.exe 2 12->18         started        signatures6 process7 dnsIp8 34 pure8s.ddnsfree.com 52.241.248.38, 49716, 49720, 49721 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 14->34 56 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 14->56 58 Found many strings related to Crypto-Wallets (likely being stolen) 14->58 60 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->60 66 4 other signatures 14->66 62 Antivirus detection for dropped file 18->62 64 Multi AV Scanner detection for dropped file 18->64 20 MSBuild.exe 1 18->20         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/db4b6c524cbbdb661779fbc66a2f4c7369df8babc733ef965b279542477b2aca
Verdict:
inconclusive
YARA:
9 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.40 Win 32 Exe x86
Link:
https://app.malva.re/file/0e8117413e01170023089c95fd91dc6f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db4b6c524cbbdb661779fbc66a2f4c7369df8babc733ef965b279542477b2aca/
Threat name:
Win32.Trojan.Mardom
Create hunting rule
Status:
Malicious
First seen:
2026-09-15 18:04:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3nfwyusmxpnwmf3z7pdgul2monu57c5ly4z67fs3e6kuer33flfa._file
Verdict:
malicious
Label(s):
PureCrypter
Create hunting rule
Link:
https://reports.threatray.com/349303c7-1535-4d84-9cb3-2cf8da50662a
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/260920-hchcnstcle/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Creates a file in the Startup directory
Unpacked files
SH256 hash:
db4b6c524cbbdb661779fbc66a2f4c7369df8babc733ef965b279542477b2aca
MD5 hash:
0e8117413e01170023089c95fd91dc6f
SHA1 hash:
edfe8c5b6e6f5c183274ba3fe584883ab28fc82d
Link:
https://www.unpac.me/results/9eb0bd65-9767-466d-8024-81cfa2bb3db7/
SH256 hash:
f01efbb979a2a479b09f5e1fe285d56c0b39f2eaa27607b06d3b834a63026cb1
MD5 hash:
c2797478cbe613ab4ab958d8798079ee
SHA1 hash:
a9369f47e93d54d93674a2ee9331b6a0c57d501b
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9eb0bd65-9767-466d-8024-81cfa2bb3db7/
SH256 hash:
2535861a35acd209a5e8480e07d35c859f599c3a13a2a2a2c5e5de76618f4675
MD5 hash:
5f3f7b74aeb829367ad495799ba081ae
SHA1 hash:
b6e59db2423e0b33cad632477c431cb89e872abf
Link:
https://www.unpac.me/results/9eb0bd65-9767-466d-8024-81cfa2bb3db7/
SH256 hash:
2cb6a099cffbb95ef22eb0e2926dbb91fc2777553bc53625099d745d5bf74318
MD5 hash:
947bd5fa692362c61306568c8856b649
SHA1 hash:
58764a174d6be62f9feeeb0fb1374614ede1790b
Link:
https://www.unpac.me/results/9eb0bd65-9767-466d-8024-81cfa2bb3db7/
SH256 hash:
adb2048540da8b4e9efa402529fbd5cc75fed1d052a5fc7c857503640f412525
MD5 hash:
d036d77642b83b20260be6325a8b0c2c
SHA1 hash:
629ceafc8db627c2a125570c14571e81b708f99c
Detections:
SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9eb0bd65-9767-466d-8024-81cfa2bb3db7/
SH256 hash:
818ccc9e090bdb10e5343a822f2e26d5e83519a88e3ead30c7fadf4bb4422915
MD5 hash:
4498b25e8da4a96583b1c2f6b47a6ac9
SHA1 hash:
aa3575749f09876915de7cdf712bdd9064cb0d27
Link:
https://www.unpac.me/results/9eb0bd65-9767-466d-8024-81cfa2bb3db7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/db4b6c524cbb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/87474/

Comments