MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PythonStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8
SHA3-384 hash: 2157628dde8d74d31603a7d8dc13939f7e3b42e5970bb560c413f1e65e9af5bc042af43c84bd9dfe677b87f45d60e2b2
SHA1 hash: 23f4766c011d193f076dfc735dc460e2a41ead79
MD5 hash: 51b6300980982a20e1464831c21988d3
humanhash: aspen-undress-uncle-william
File name:DAVOS_Pakistan_Business_Summit.exe
Download: download sample
Signature PythonStealer
Create hunting rule
File size:6'371'328 bytes
First seen:2025-12-26 05:32:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash aaaa97ae38376e73b9cc256f241c9f8f (2 x PythonStealer, 1 x SalatStealer)
ssdeep 98304:bZJYcN5HcovPYWzGwVsi0DHmp80tiV2aprcl0+eXxkOk0oR8LAMpa2AcwxEg:dCC5hvPfzGwVsxDHM80tY2M3XxkxHae
TLSH T1045633ED52C282BCC74797B0ADF926630BF2EC5A462283FB545132D90D238E55E2B7C5
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter __0XYC__
Tags:apt exe PythonStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
IE IE
Vendor Threat Intelligence
Malware configuration found for:
Nuitka
Details
Nuitka
an extracted Nuitka compiled file
Link:
https://research.acce.ciphertechsolutions.com/results/c03bb98b-8c26-4930-8b92-c538f3731e9a/
Malware family:
n/a
ID:
1
File name:
DAVOS_Pakistan_Business_Summit.exe
Verdict:
Malicious activity
Analysis date:
2025-12-26 05:35:27 UTC
Tags:
nuitka python
Link:
https://app.any.run/tasks/3bde2d50-93e5-40dd-8eea-12eb0a7d0f20

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46147/
Detection(s):
PUA.Win.Packer.Nuitka-9992781-0
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694e1e1e038f10550b55e37d
Tags:
vmdetect extens shell sage
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm expand lolbin microsoft_visual_cc nuitka packed packed
Link:
https://www.filescan.io/uploads/694e1e1be126b9ff4391ce3d/reports/3e763069-b597-46f7-b5ec-6ec603393500/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-17T07:58:00Z UTC
Last seen:
2025-12-26T20:50:00Z UTC
Hits:
~100
Detections:
Trojan.Win64.Agentb.lfxl
Link:
https://opentip.kaspersky.com/deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5e2160f5-f45c-4d6e-9101-df8e8cc5ee75
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/51b6300980982a20e1464831c21988d3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8/
Verdict:
Malicious
Threat:
Family.PYTHONSTEALER
Link:
https://tip.neiki.dev/file/deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8
Threat name:
Win64.Trojan.Midie
Create hunting rule
Status:
Malicious
First seen:
2025-12-26 05:33:17 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=32zedjdnuga4rqpwrjbxix6l7ctje7sditbpzfxpjtzrzaufo3ea._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/251226-f8ycna1kbl/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a977bc19-390a-436f-b83f-f6a3045c17c9
Unpacked files
SH256 hash:
deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8
MD5 hash:
51b6300980982a20e1464831c21988d3
SHA1 hash:
23f4766c011d193f076dfc735dc460e2a41ead79
Link:
https://www.unpac.me/results/56433937-c649-4279-945e-7fb71e406628/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/46147/

Comments