MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f1025f62299900f6d79868a33d033fd897a14c15bd25a48db614126e4a79aee2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SolarisLoader
Vendor detections: 13
| SHA256 hash: | f1025f62299900f6d79868a33d033fd897a14c15bd25a48db614126e4a79aee2 |
|---|---|
| SHA3-384 hash: | a5bd5bd5ffac32e7fdb0941895503a98b70f2391f54fe8febd3b0138b5bb1d061428230586412e0f6d8b2e08697a6c09 |
| SHA1 hash: | 09dd686582f8de58acdcfdad877a1504f0b5be0c |
| MD5 hash: | f482dd98b7b2182e08cf400370aa20cd |
| humanhash: | mexico-high-thirteen-october |
| File name: | crkhost.exe |
| Download: | download sample |
| Signature | SolarisLoader |
| File size: | 199'680 bytes |
| First seen: | 2026-05-02 04:54:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 0be878847a955d68de7730bad92f9303 (4 x SolarisLoader, 1 x RemusStealer, 1 x Stealc) |
| ssdeep | 3072:jerKPXpRlvxYC6kHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:jeGfblvxYSyrWpAKhhvORHJ |
| TLSH | T1D6147C4373E925E5F5738674C5A58A57E771B82213209FEF07A0861A1F237C2AD39F22 |
| TrID | 33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| Reporter |  BastianHein |
| Tags: | exe SolarisLoader |
Intelligence
File Origin
# of uploads :
1
# of downloads :
138
Origin country :
CLVendor Threat Intelligence
Malware configuration found for:
PECrypter
Details
PECrypter
extracted PE file component(s) (plaintext) from the .data section
Malware family:
amadey
ID:
1
File name:
stripe_checker.exe
Verdict:
Malicious activity
Analysis date:
2026-05-01 18:55:34 UTC
Tags:
stealc stealer payload nuitka auto-reg amadey botnet python loader openssl tool generic pyinstaller
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Creating a process from a recently created file
Creating a service
Loading a system driver
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Searching for synchronization primitives
Enabling autorun for a service
Blocking the Windows Defender launch
Blocking the Windows Security Center launch
Forced shutdown of a system process
Connection attempt to an infection source
Changing the hosts file
Enabling autorun by creating a file
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug evasive evasive exploit explorer lolbin microsoft_visual_cc mpcmdrun
Verdict:
Malicious
Labled as:
Dropper.Trojan.Generic
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-05-01T02:22:00Z UTC
Last seen:
2026-05-01T03:23:00Z UTC
Hits:
~100
Verdict:
Malicious
Score:
99%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Threat name:
Win64.Trojan.Stealc
Status:
Malicious
First seen:
2026-05-01 11:50:52 UTC
File Type:
PE+ (Exe)
Extracted files:
5
AV detection:
20 of 36 (55.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes dropped EXE
Sets service image path in registry
Unpacked files
SH256 hash:
f1025f62299900f6d79868a33d033fd897a14c15bd25a48db614126e4a79aee2
MD5 hash:
f482dd98b7b2182e08cf400370aa20cd
SHA1 hash:
09dd686582f8de58acdcfdad877a1504f0b5be0c
SH256 hash:
5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8
MD5 hash:
a641a6184845dfbbb5f0fff2e3a059f2
SHA1 hash:
01d66a8288c5c7078c0f8b75aae610a40ac5585a
Detections:
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables embedding registry key / value combination indicative of disabling Windows Defender features |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
| Rule name: | INDICATOR_SUSPICIOUS_ReflectiveLoader |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Reflective DLL injection artifacts |
| Rule name: | ReflectiveLoader |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended |
| Reference: | Internal Research |
| Rule name: | SUSP_XORed_Mozilla_Oct19 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. |
| Reference: | https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force() |
| Rule name: | SUSP_XORed_Mozilla_RID2DB4 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
| Rule name: | Windows_Trojan_CobaltStrike_f0b627fc |
|---|---|
| Description: | Rule for beacon reflective loader |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.