MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ResolverRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48
SHA3-384 hash: 4716a57361bccc630f494e9ab9bb848189422d689bf49b4470aecb1ec550451119e5eb5dfa28f17a0ccabcd003072660
SHA1 hash: bfaef8f28b0bb463649f14a8b30a2699e5d0010f
MD5 hash: 5f9ce82bba53a55288580f3522710ef1
humanhash: march-blue-stairway-william
File name:5f9ce82bba53a55288580f3522710ef1.exe
Download: download sample
Signature ResolverRAT
Create hunting rule
File size:1'066'100 bytes
First seen:2025-07-14 05:27:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'503 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 24576:UnaFTHPrhQ/+btGavkIdJx2Z4cu7EGt9t+qG:UaFGCAxyJIVuDzNG
Threatray 112 similar samples on MalwareBazaar
TLSH T14E35E120FA4CDCAAF06318B19976D6402855797D8469643EB5AFF96E80F3383215FE0F
TrID 80.0% (.EXE) Inno Setup installer (107240/4/30)
10.5% (.EXE) Win32 Executable Delphi generic (14182/79/4)
3.3% (.EXE) Win32 Executable (generic) (4504/4/1)
1.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
1.5% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon a9c0999999997f6d (1 x ResolverRAT)
Reporter abuse_ch
Tags:exe ResolverRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
30
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48.exe
Verdict:
Malicious activity
Analysis date:
2025-07-14 05:28:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f63d1e18-bd3f-433a-bef0-20fd741dbbe4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/14157/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68749574c9eb97473768c04c
Tags:
dropper extens spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Restart of the analyzed sample
Creating a process with a hidden window
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Launching a process
Loading a suspicious library
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Enabling the 'hidden' option for recently created files
Creating a file
Connection attempt
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint installer obfuscated overlay packed packer_detected
Link:
https://www.filescan.io/uploads/6874956896dca6658850a374/reports/f421219f-cdf0-4327-89bb-edce4cec0c7c/overview
Verdict:
Malicious
Labled as:
Win64_Kryptik_ETA
Link:
https://www.hybrid-analysis.com/sample/e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/65e3fe7a-24f5-49a0-ad64-fdeae306d9e8
Result
Threat name:
PureCrypter, ResolverRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1735641
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Detected PureCrypter Trojan
Found many strings related to Crypto-Wallets (likely being stolen)
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sets debug register (to hijack the execution of another thread)
Sigma detected: Potentially Suspicious Child Process Of Regsvr32
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal Bitcoin Wallet information
Yara detected ResolverRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1735641 Sample: DguhScRjXj.exe Startdate: 14/07/2025 Architecture: WINDOWS Score: 100 63 Suricata IDS alerts for network traffic 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 Multi AV Scanner detection for dropped file 2->67 69 6 other signatures 2->69 12 DguhScRjXj.exe 2 2->12         started        15 regsvr32.exe 2->15         started        process3 file4 57 C:\Users\user\AppData\...\DguhScRjXj.tmp, PE32 12->57 dropped 17 DguhScRjXj.tmp 6 12->17         started        process5 file6 41 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 17->41 dropped 43 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 17->43 dropped 45 C:\Users\user\AppData\Local\...\_RegDLL.tmp, PE32 17->45 dropped 20 DguhScRjXj.exe 2 17->20         started        process7 file8 47 C:\Users\user\AppData\...\DguhScRjXj.tmp, PE32 20->47 dropped 23 DguhScRjXj.tmp 6 20->23         started        process9 file10 49 C:\Users\user\AppData\...\is-HOISV.tmp, PE32+ 23->49 dropped 51 WindowsUpdate-Auth...1fde65fa.crt (copy), PE32+ 23->51 dropped 53 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 23->53 dropped 55 2 other files (none is malicious) 23->55 dropped 26 regsvr32.exe 23->26         started        process11 process12 28 regsvr32.exe 1 3 26->28         started        dnsIp13 59 202.162.108.17, 49721, 56001 BCPL-SGBGPNETGlobalASNSG Singapore 28->59 71 System process connects to network (likely due to code injection or exploit) 28->71 73 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 28->73 75 Found many strings related to Crypto-Wallets (likely being stolen) 28->75 77 7 other signatures 28->77 32 powershell.exe 37 28->32         started        35 powershell.exe 28->35         started        signatures14 process15 signatures16 61 Loading BitLocker PowerShell Module 32->61 37 conhost.exe 32->37         started        39 conhost.exe 35->39         started        process17
Score:
60%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/5f9ce82bba53a55288580f3522710ef1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48/
Verdict:
Malicious
Threat:
trojan.gatak/kadgo
Link:
https://tip.neiki.dev/file/e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-07-11 15:16:00 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
17 of 38 (44.74%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4re5o36pyzg5ed65a75r77dvucup2j6ipctnezizfzslgo3nbnea._file
Verdict:
malicious
Label(s):
resolverrat
Create hunting rule
Similar samples:
00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9
ResolverRAT
50deae409fb59a34e979ff03ca4275e42ee84244bc0c0ab9969fae5d7bbfb170
ResolverRAT
8463e7562950ad08408ab5c2a84bca81c3088187c3fb448c8aeb5b0d36a89a09
ResolverRAT
c3d49b625f72eb6ce52ddbcfa28ddea1b0cbda77dab0df8cc13bd05a05414a49
ResolverRAT
e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48
ResolverRAT
e82fc61f7f9d57734370142015cd49bd4fa9d4cb50e475f78e44645c064a1ba0
ResolverRAT
ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c
ResolverRAT
error
ResolverRAT
+ 102 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery
Link:
https://tria.ge/reports/250714-f5195sysez/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f04a93b7-726b-4e88-bd4e-067fe3c35247
Unpacked files
SH256 hash:
e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48
MD5 hash:
5f9ce82bba53a55288580f3522710ef1
SHA1 hash:
bfaef8f28b0bb463649f14a8b30a2699e5d0010f
Link:
https://www.unpac.me/results/c7224420-3f1e-49a3-a48e-ef7ebd523003/
SH256 hash:
41037cd2466597387437e6e931979da7161fba3ce48d9aedd863fd5f34b76e21
MD5 hash:
b220644245c307a25d5048a84c0b4c13
SHA1 hash:
c1d2d423be6dd092982cbfdd19b2a8fa1058a881
Link:
https://www.unpac.me/results/c7224420-3f1e-49a3-a48e-ef7ebd523003/
SH256 hash:
a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81
MD5 hash:
4ff75f505fddcc6a9ae62216446205d9
SHA1 hash:
efe32d504ce72f32e92dcf01aa2752b04d81a342
Link:
https://www.unpac.me/results/c7224420-3f1e-49a3-a48e-ef7ebd523003/
SH256 hash:
4dc09bac0613590f1fac8771d18af5be25a1e1cb8fdbf4031aa364f3057e74a2
MD5 hash:
0ee914c6f0bb93996c75941e1ad629c6
SHA1 hash:
12e2cb05506ee3e82046c41510f39a258a5e5549
Link:
https://www.unpac.me/results/c7224420-3f1e-49a3-a48e-ef7ebd523003/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/c7224420-3f1e-49a3-a48e-ef7ebd523003/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e449d76fcfc64dd20fdd07fb1ffc75a0a8fd27c878a6d265192e64b33b6d0b48

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:ScanStringsInsocks5systemz
Create hunting rule
Author:Byambaa@pubcert.mn
Description:Scans presence of the found strings using the in-house brute force method
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Donutloader_f40e3759
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/14157/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CreateProcessA
advapi32.dll::OpenProcessToken
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::GetWindowsDirectoryA
kernel32.dll::GetFileAttributesA
kernel32.dll::RemoveDirectoryA
WIN_BASE_USER_APIRetrieves Account Informationadvapi32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments