MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e44250c76f444640ca1e8360ee8fb9e80dec183555b620a46d16e78f53557aba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureCrypter

Vendor detections: 8

Intelligence 8 IOCs YARA 9 File information Comments

SHA256 hash:	e44250c76f444640ca1e8360ee8fb9e80dec183555b620a46d16e78f53557aba
SHA3-384 hash:	118b6d5b1f9f568cc43555d435189beac6b7ce71f8d43cbc092980cf76f53529a2088735b1005137489cca814253226f
SHA1 hash:	4d483f718cbe30ed2671570846ebd28a6c84600f
MD5 hash:	515d476d2026dfa5f525cb94d6f40636
humanhash:	burger-april-papa-stream
File name:	Installer.iso
Download:	download sample
Signature	PureCrypter Create hunting rule
File size:	15'273'984 bytes
First seen:	2026-03-14 15:14:14 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	196608:UQWbvGzcyUETU0oaM3oD2srGTtLkPY8EmU+/1BEDORwEriGNY11hGKLU9PLyTn2L:ajzCjMeWLAxU+vEDsiGNW1h2PLQhJ
TLSH	T137F633556F93F0D1C50F8A7B1B820445D7B21E2DBA9E240B770D3B9523B96E7CF18AA0
TrID	88.5% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika	iso
Reporter	aachum
Tags:	https://tabbysbakescodes.ws/CNB/gate.php iso Jalapeno purecrypter tabbysbakescodes-ws

iamaachum

https://dl89sfilesbase.top/downloads/Ys8jTe0P/AppSetup

C2: https://tabbysbakescodes.ws/CNB/gate.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	ReadMe.txt
File size:	761 bytes
SHA256 hash:	8dac22f984bff8e1162b63065ed3b990b44fe9b7a2da940ca3a6053c202a1bc3
MD5 hash:	ff0400d5397036ff353727a5f9941455
MIME type:	text/plain
Signature	PureCrypter

File name:	Installer_v5435_x64.exe
File size:	15'220'224 bytes
SHA256 hash:	7785d48cc964bdc333e08d1e9acfb640bbe9a8927fd47fa0001349d8ee20a527
MD5 hash:	9d2a38b6bb73d2bd7dec3c9deb7ad15f
MIME type:	application/x-dosexec
Signature	PureCrypter

Vendor Threat Intelligence

Malware configuration found for:

Details

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion execution persistence themida trojan

Link:

https://tria.ge/reports/260314-sxrrysbz4s/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Looks up external IP address via web service

Checks BIOS information in registry

Executes dropped EXE

Themida packer

Command and Scripting Interpreter: PowerShell

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e44250c76f444640ca1e8360ee8fb9e80dec183555b620a46d16e78f53557aba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)