🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b
SHA3-384 hash: 348bc1c852e083fe98442d2e9ce911a93435d6e67d02dd871c6f432406fd81edae16753151ee77a20e610b11362b5640
SHA1 hash: 12f3aaff50cd39f2ecdc46855437fb545774afdb
MD5 hash: 0a2025aba8a9538b5f03e12ed99b488e
humanhash: shade-two-artist-california
File name:dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b.exe
Download: download sample
Signature RevStealer
Create hunting rule
File size:3'008'000 bytes
First seen:2026-11-07 02:17:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 3b33063fa6540cfc510bd20fcc99cc96 (18 x RevStealer)
ssdeep 49152:hRE/RBRj4Rc1eCIzpCs6dLUdJEl71IOJBtMbz9PeU2kYY15uGm1fLJVhyg3ufoR0:I/rRjT1enpCRLCs71Brw9WLjcuGMLfZF
TLSH T16DD52399FC826475E8B7C7734393642EB12C7B8143A08D57B1C86B607DA2A18AC7737D
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Tuxxin
Tags:exe RevStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
211
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f434b46a-9729-4955-8ff9-bd253f072dcd/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-07 03:46:09 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/151bb1f9-56ce-4617-8ed4-735de9c56531

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97871/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1bbe1ac89c90fc65a55ea
Tags:
injection autorun sage remo
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b
Verdict:
Malicious
File Type:
exe x64
Link:
https://opentip.kaspersky.com/dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/dc0e3977-ca34-4ca2-8553-0f5497da7368
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2000325
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates / moves files in alternative data streams (ADS)
Deletes itself after installation
Found direct / indirect Syscall (likely to bypass EDR)
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries DNS domain through GetComputerNameExW (potential sandbox evasion)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2000325 Sample: M04ZH61qQu.exe Startdate: 07/11/2026 Architecture: WINDOWS Score: 100 39 trace9.web-nest.xyz 2->39 41 index.brew-reef.lat 2->41 43 api.telegra.ph 2->43 53 Antivirus detection for URL or domain 2->53 55 Antivirus / Scanner detection for submitted sample 2->55 57 Multi AV Scanner detection for dropped file 2->57 61 3 other signatures 2->61 9 M04ZH61qQu.exe 6 2->9         started        13 WindowsTouchService.exe 2->13         started        15 explorer.exe 52 1 2->15 injected signatures3 59 Performs DNS queries to domains with low reputation 39->59 process4 file5 29 C:\Users\user\...\WindowsTouchService.exe, PE32+ 9->29 dropped 31 WindowsTouchService.exe:Zone.Identifier, ASCII 9->31 dropped 63 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->63 65 Creates / moves files in alternative data streams (ADS) 9->65 67 Uses schtasks.exe or at.exe to add and modify task schedules 9->67 69 Deletes itself after installation 9->69 17 WindowsTouchService.exe 103 9->17         started        21 schtasks.exe 1 9->21         started        33 :fh (copy), PE32+ 13->33 dropped 71 Found direct / indirect Syscall (likely to bypass EDR) 13->71 signatures6 process7 dnsIp8 35 api.telegra.ph 149.154.164.13, 443, 49736 TELEGRAMVG Netherlands 17->35 37 trace9.web-nest.xyz 104.21.40.128, 443, 49737, 49738 CLOUDFLARENET-CloudflareIncUS Canada 17->37 45 Antivirus detection for dropped file 17->45 47 Multi AV Scanner detection for dropped file 17->47 49 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 17->49 51 4 other signatures 17->51 23 schtasks.exe 1 17->23         started        25 conhost.exe 21->25         started        signatures9 process10 process11 27 conhost.exe 23->27         started       
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/0a2025aba8a9538b5f03e12ed99b488e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b/
Threat name:
Win64.Trojan.AdvML
Create hunting rule
Status:
Malicious
First seen:
2026-11-06 21:25:07 UTC
File Type:
PE+ (Exe)
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=37g56sgvsascas3v3dgajo6bwa6xx2o7hkbwzl5lyawc2a57snnq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery execution persistence spyware stealer trojan
Link:
https://tria.ge/reports/261107-cray9adg78/
Behaviour
Modifies system certificate store
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: RenamesItself
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Reads the TCP/IP host and domain name from the registry
Accesses cryptocurrency files/wallets, possible credential harvesting
Deletes itself
Executes dropped EXE
Reads user/profile data of web browsers
Malware Family:
n/a
Verdict:
Malicious
Tags:
loader rat stealer evasion
YARA:
n/a
Link:
https://app.threat.zone/submission/b64a99c7-5010-4dfd-bd9b-9bdfa7b45cb1
Malware Family:
coins
Create hunting rule
Malicious:
True
Tags:
64bits spreader obfuscated detect-debug-environment long-sleeps self-delete
Link:
https://intel.virussign.com/intelligence/file/dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b
Unpacked files
SH256 hash:
dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b
MD5 hash:
0a2025aba8a9538b5f03e12ed99b488e
SHA1 hash:
12f3aaff50cd39f2ecdc46855437fb545774afdb
Link:
https://www.unpac.me/results/8d1fd8c8-2657-4be8-90cf-b0165ad10d75/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RevStealer

Executable exe dfcddf48d59024204b75d8cc04bbc1b03d7be9df3a836cafabc02c2d03bf935b

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/97871/

Comments