MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SantaStealer
Vendor detections: 14
| SHA256 hash: | f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d |
|---|---|
| SHA3-384 hash: | 3e96e4dc4ec4e764c8497036a04ed0aab3d81d00d7f50ccc378b2bdcf88464f9299586eb58a4fe1591375a7393c8bc68 |
| SHA1 hash: | 51bc8a328390528342f677a184ff10ee2afa3027 |
| MD5 hash: | 4d35d2f07cbacdf559f55cd47911a0a6 |
| humanhash: | illinois-august-avocado-potato |
| File name: | file |
| Download: | download sample |
| Signature | SantaStealer |
| File size: | 4'511'744 bytes |
| First seen: | 2026-04-15 11:10:46 UTC |
| Last seen: | 2026-04-15 22:47:50 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ed6edba9ec77ed904b0920d79686675c (3 x SantaStealer) |
| ssdeep | 49152:17qvgQsBZJ69JtbivwA9qtnew8EJRddY0hLIbxRtnFD1WfHdsl2wzdroItxKj+be:1J69mv0newpZAh1W+PYXr1MTmNxMUB |
| Threatray | 109 similar samples on MalwareBazaar |
| TLSH | T151269DA7E16A50E8C46BC0329757EA31FA30B85900347EAA0E96C7203F71D71AB5DF57 |
| TrID | 45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 18.0% (.EXE) Win64 Executable (generic) (6522/11/2) 13.9% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.ICL) Windows Icons Library (generic) (2059/9) 5.6% (.EXE) OS/2 Executable (generic) (2029/13) |
| Magika | pebin |
| Reporter |  Bitsight |
| Tags: | dropped-by-amadey exe fbf543 SantaStealer |
Intelligence
File Origin
# of uploads :
14
# of downloads :
143
Origin country :
USVendor Threat Intelligence
No detections
Malware family:
teamviewer
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2026-04-15 11:11:27 UTC
Tags:
auto-reg stealer teamviewer rmm-tool tightvnc santastealer telegram vidar
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Verdict:
Malicious
Score:
97.4%
Tags:
infosteal phishing emotet lien
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Launching a process
Creating a process with a hidden window
Loading a suspicious library
Creating a window
Reading critical registry keys
Changing a file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Stealing user critical data
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug base64 crypto expand fingerprint hacktool infostealer lolbin overlay packed rundll32 zusy
Verdict:
Malicious
Labled as:
Zusy.Generic
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-04-15T08:28:00Z UTC
Last seen:
2026-04-15T14:11:00Z UTC
Hits:
~100
Detections:
Trojan-Dropper.Win32.Injector.sb Backdoor.Win32.Androm.sb Trojan-Banker.Win32.ClipBanker.sb Trojan-PSW.Win32.Greedy.sb Trojan-PSW.Stealer.HTTP.C&C Trojan.Win32.Inject.sb PDM:Trojan.Win32.Generic Trojan.Win32.DLLhijack.sb Trojan-PSW.Win32.Lumma.sb Trojan-PSW.Win32.Vidar.sb Trojan-Banker.Win32.ClipBanker.aidh Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Coins.sb Trojan-Spy.Win32.Stealer.sb Trojan-Spy.Win32.SpyEyes Trojan-PSW.Win32.Lumma.acqu
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Verdict:
Malicious
Threat:
Family.SANTASTEALER
Threat name:
Win64.Trojan.Egairtigado
Status:
Malicious
First seen:
2026-04-15 11:12:14 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
16 of 24 (66.67%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
santastealer
Similar samples:
+ 99 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
credential_access discovery persistence spyware stealer
Behaviour
Checks processor information in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Browser Information Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Credentials from Password Stores: Windows Credential Manager
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
f2a18b8cbd488142b3d2c00e89128cb52e73f3aeb63b3fbdd63c6dc9ccf5e82d
MD5 hash:
4d35d2f07cbacdf559f55cd47911a0a6
SHA1 hash:
51bc8a328390528342f677a184ff10ee2afa3027
SH256 hash:
0e822f999f8fa0bc423f5bdc71a8835bffd5a84d34b32b4a677ae24649f1c570
MD5 hash:
01b573cffb40a816e799c959f60f7e26
SHA1 hash:
3568b8a3fcf9451a23677797413e3507b3524b3e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Check_OutputDebugStringA_iat |
|---|
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing SQL queries to confidential data stores. Observed in infostealers |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | ThreadControl__Context |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments |
| Reference: | https://cyfare.net/ |
| Rule name: | TH_Generic_MassHunt_Win_Malware_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Windows malware mass-hunt rule - 2025 |
| Reference: | https://cyfare.net/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Dropped by
Amadey
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.