🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c
SHA3-384 hash: f505dbe2f263753f2d1d9f3575b56429cb24c58346236a60335139bad8e0bb1919218b06bc9fede9a91aedd36c8019fa
SHA1 hash: 4cd5044ec57fe2e05750c360eaf1b052e249c948
MD5 hash: 0de6f25ffcb9419b4c7c0755c503e22a
humanhash: mexico-magnesium-table-september
File name:2.exe
Download: download sample
File size:197'632 bytes
First seen:2026-05-08 10:09:06 UTC
Last seen:2026-06-23 09:26:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0be878847a955d68de7730bad92f9303 (4 x SolarisLoader, 1 x RemusStealer, 1 x Stealc)
ssdeep 3072:tZsrgqUN89vy+zkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:tZgUN8JyxyrWpAKhhvORHJ
TLSH T1AE147B5763E520EAE1738674CAA58706F771B8261710ABEF07A0C6191F237D1AD3DF22
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
122
Origin country :
GR GR
Vendor Threat Intelligence
Malware configuration found for:
PECrypter
Details
PECrypter
extracted PE file component(s) (plaintext) from the .data section
Link:
https://research.acce.ciphertechsolutions.com/results/a70df904-d6bf-4a33-b9d6-697ae62bedd8/
Malware family:
amadey
Create hunting rule
ID:
1
File name:
inf.rar
Verdict:
Malicious activity
Analysis date:
2026-05-05 09:38:33 UTC
Tags:
arch-exec generic golang stealc stealer amadey botnet
Link:
https://app.any.run/tasks/60c58fe0-5148-44ab-af5e-7c8289e5a2b8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/64871/
Detection(s):
SecuriteInfo.com.Trojan.Siggen32.38994.15732.16898.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Creating a process from a recently created file
Creating a service
Loading a system driver
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Searching for synchronization primitives
Enabling autorun for a service
Blocking the Windows Defender launch
Blocking the Windows Security Center launch
Forced shutdown of a system process
Connection attempt to an infection source
Changing the hosts file
Enabling autorun by creating a file
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug evasive exploit explorer lolbin microsoft_visual_cc mpcmdrun obfuscated overlay packed stealc unsafe
Link:
https://www.filescan.io/uploads/69fdb65f2fcb905ec2881c2b/reports/3c6429d7-4712-4cfb-add6-f3bcadb604ee/overview
Verdict:
Malicious
Labled as:
Dropper.Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-05-04T08:50:00Z UTC
Last seen:
2026-05-08T19:52:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/289af442-ce24-4166-8b41-732715522e09
Result
Threat name:
AsyncRAT, Clipboard Hijacker, Stealc v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1910602
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Changes memory attributes in foreign processes to executable or writable
Changes security center settings (notifications, updates, antivirus, firewall)
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Contains VNC / remote desktop functionality (version string found)
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
Drops PE files with benign system names
Early bird code injection technique detected
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Monitors registry run keys for changes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Sample is not signed and drops a device driver
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AsyncRAT
Yara detected Clipboard Hijacker
Yara detected Stealc v2
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1910602 Sample: 2.exe Startdate: 08/05/2026 Architecture: WINDOWS Score: 100 86 id89652.cfd 2->86 88 comples.biz 2->88 96 Suricata IDS alerts for network traffic 2->96 98 Found malware configuration 2->98 100 Malicious sample detected (through community Yara rule) 2->100 102 16 other signatures 2->102 9 WinUpdateHelper.exe 2 16 2->9         started        14 winhost.exe 12 2->14         started        16 SvcHostAnalyzer.exe 4 1 2->16         started        18 11 other processes 2->18 signatures3 process4 dnsIp5 94 id89652.cfd 62.60.226.159, 49715, 49716, 49717 ASLINE-AS-APASLINELIMITEDHK Iran (ISLAMIC Republic Of) 9->94 68 C:\Users\user\AppData\Roaming\...\winhost.exe, PE32+ 9->68 dropped 70 C:\Users\user\AppData\Local\...\tl8eom6e.exe, PE32+ 9->70 dropped 72 C:\Users\user\AppData\Local\...\t71aatw6.exe, PE32+ 9->72 dropped 80 5 other malicious files 9->80 dropped 130 Multi AV Scanner detection for dropped file 9->130 132 Found evasive API chain (may stop execution after checking mutex) 9->132 134 Found stalling execution ending in API Sleep call 9->134 148 7 other signatures 9->148 20 sk94k4lb.exe 9->20         started        25 tl8eom6e.exe 9->25         started        27 5xn26y30.exe 9->27         started        35 10 other processes 9->35 74 C:\Users\user\AppData\Local\...\wv2jp6fx.exe, PE32+ 14->74 dropped 76 C:\Users\user\AppData\Local\...\th4n6tq3.exe, PE32+ 14->76 dropped 82 2 other malicious files 14->82 dropped 136 Contains functionality to inject threads in other processes 14->136 138 Injects code into the Windows Explorer (explorer.exe) 14->138 140 Writes to foreign memory regions 14->140 29 wv2jp6fx.exe 14->29         started        31 th4n6tq3.exe 14->31         started        33 mdyo5wpo.exe 14->33         started        37 4 other processes 14->37 78 C:\Users\user\...mbeddedDriverService.sys, PE32+ 16->78 dropped 142 Sample is not signed and drops a device driver 16->142 84 2 other malicious files 18->84 dropped 144 Contains functionality to bypass UAC (CMSTPLUA) 18->144 146 Changes security center settings (notifications, updates, antivirus, firewall) 18->146 file6 signatures7 process8 dnsIp9 90 comples.biz 213.199.54.45, 49761, 8768 ASN-ATLANETIT United Kingdom 20->90 54 C:\Users\user\...\wmok7wP9D5Jwm9J7PuZ.exe, PE32+ 20->54 dropped 56 C:\Users\user\...\oDJHi505VHeo5R4ki69w1F9.exe, PE32+ 20->56 dropped 58 C:\Users\...\X9o5188eH1Lu73H9s9DJToPsa.exe, PE32+ 20->58 dropped 66 2 other malicious files 20->66 dropped 104 Antivirus detection for dropped file 20->104 106 Multi AV Scanner detection for dropped file 20->106 108 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->108 120 7 other signatures 20->120 92 196.251.107.130, 49730, 80 ANGANI-ASKE Seychelles 25->92 110 Early bird code injection technique detected 25->110 112 Found many strings related to Crypto-Wallets (likely being stolen) 25->112 122 3 other signatures 25->122 39 chrome.exe 25->39         started        41 msedge.exe 25->41         started        124 3 other signatures 27->124 126 3 other signatures 29->126 60 C:\Users\user\Pictures\svchost.exe, PE32+ 31->60 dropped 62 C:\Users\user\AppData\Roaming\vuuzwr.exe, PE32+ 31->62 dropped 128 2 other signatures 31->128 43 schtasks.exe 31->43         started        45 schtasks.exe 31->45         started        64 C:\ProgramData\vbagi.exe, PE32+ 33->64 dropped 114 Monitors registry run keys for changes 35->114 47 svchost.exe 35->47         started        116 Found evasive API chain (may stop execution after checking mutex) 37->116 118 Unusual module load detection (module proxying) 37->118 file10 signatures11 process12 signatures13 50 conhost.exe 43->50         started        52 conhost.exe 45->52         started        150 Multi AV Scanner detection for dropped file 47->150 process14
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/0de6f25ffcb9419b4c7c0755c503e22a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c/
Threat name:
Win64.Trojan.Stealc
Create hunting rule
Status:
Malicious
First seen:
2026-05-04 13:20:09 UTC
File Type:
PE+ (Exe)
Extracted files:
5
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4opw2z6d3fuizzsxitqjnrt5xdz2yfww7y2dzmlbdcp7ucromwoa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/260508-l8xzsaay2j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes dropped EXE
Sets service image path in registry
Unpacked files
SH256 hash:
e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c
MD5 hash:
0de6f25ffcb9419b4c7c0755c503e22a
SHA1 hash:
4cd5044ec57fe2e05750c360eaf1b052e249c948
Link:
https://www.unpac.me/results/a2d713ec-88f8-48b3-bf82-fa9c1e556982/
SH256 hash:
5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8
MD5 hash:
a641a6184845dfbbb5f0fff2e3a059f2
SHA1 hash:
01d66a8288c5c7078c0f8b75aae610a40ac5585a
Link:
https://www.unpac.me/results/a2d713ec-88f8-48b3-bf82-fa9c1e556982/
Parent samples :
f1025f62299900f6d79868a33d033fd897a14c15bd25a48db614126e4a79aee2
5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:Detects Reflective DLL injection artifacts
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Trojan_CobaltStrike_f0b627fc
Create hunting rule
Description:Rule for beacon reflective loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe e39f6d67c3d9688ce65744e096c67db8f3ac16d6fe343cb161189ffa0a2e659c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3721649/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/64871/

Comments