MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8fb4cb45e9e573bc6e0ad13ed90a36a0f363054ebca9d53fa5582207bdc6265. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CripStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 36 File information Comments

SHA256 hash:	f8fb4cb45e9e573bc6e0ad13ed90a36a0f363054ebca9d53fa5582207bdc6265
SHA3-384 hash:	ff8da448ccbc89df9d7769ce64e1fe171f6318d8cef8e21e0c290e0e5a8cb7966f1849b70c9ccddfc281e82a1f711df8
SHA1 hash:	44d553348bab6048dd22d222face00225508f6de
MD5 hash:	53262ea8f36c9ae7f8f4186b1654738d
humanhash:	grey-connecticut-potato-pasta
File name:	f8fb4cb45e9e573bc6e0ad13ed90a36a0f363054ebca9d53fa5582207bdc6265.exe
Download:	download sample
Signature	CripStealer Create hunting rule
File size:	599'552 bytes
First seen:	2026-10-14 16:23:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'612 x Formbook, 12'394 x SnakeKeylogger)
ssdeep	6144:tTQdVAUnt4AZu3Gl2g2R9+gcrzhL7m0dPu+1kEpacPWnV5MbrRLJdbQv7UEKnZIx:t0bAUnqAZNgcrzYuG5h8sI9cD
TLSH	T1DCD45C49B3E80129F2BF8A7C98720545C7B1B8528B65E3DF0A9455D91E33BD0ED39B23
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	ShadowOpCode
Tags:	CripStealer exe RGBLoader

Intelligence

File Origin

# of uploads :

# of downloads :

178

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

agenttesla

ID:

File name:

https://temp.sh/HVmiT/RGBLoader.zip

Verdict:

Malicious activity

Analysis date:

2026-10-14 15:16:47 UTC

Tags:

rat pulsar netreactor ip-check evasion stealer agenttesla ftp exfiltration uac xworm screenconnect rmm-tool smtp ultravnc telegram snake keylogger

Link:

https://app.any.run/tasks/4e9aec16-036a-4d91-93e0-a1a6602cbb3d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92053/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating synchronization primitives

Creating a file in the %temp% directory

Deleting a recently created file

Reading critical registry keys

Launching a process

Launching the process to change network settings

Launching the process to interact with network services

Searching for synchronization primitives

Launching a service

Changing a file

Sending a custom TCP request

Creating a window

DNS request

Using the Windows Management Instrumentation requests

Connection attempt

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm base64 crypto crypto evasive expand exploit fingerprint fingerprint hacktool lolbin obfuscated privilege reconnaissance runonce telegram

Link:

https://www.filescan.io/uploads/6acfac875fe91cc0f60381b3/reports/849b007a-a8b1-42df-9475-1f25437d458f/overview

Verdict:

Malicious

Labled as:

IL:Trojan.MSILZilla

Link:

https://www.hybrid-analysis.com/sample/f8fb4cb45e9e573bc6e0ad13ed90a36a0f363054ebca9d53fa5582207bdc6265

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-10T18:58:00Z UTC

Last seen:

2026-10-10T19:24:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f8fb4cb45e9e573bc6e0ad13ed90a36a0f363054ebca9d53fa5582207bdc6265/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/196316f4-87a6-4721-928c-21f3fdb57622

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f8fb4cb45e9e573bc6e0ad13ed90a36a0f363054ebca9d53fa5582207bdc6265

Verdict:

inconclusive

YARA:

12 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.23 Win 32 Exe x86

Link:

https://app.malva.re/file/53262ea8f36c9ae7f8f4186b1654738d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f8fb4cb45e9e573bc6e0ad13ed90a36a0f363054ebca9d53fa5582207bdc6265/

Threat name:

ByteCode-MSIL.Hacktool.PSWDump

Status:

Malicious

First seen:

2026-10-10 23:40:05 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

30 of 36 (83.33%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7d5uznc6tzltxrxavuj63efdnihtmmcu5pfj2u72kwbca664mjsq._file

Verdict:

malicious

Label(s):

CripStealer

Link:

https://reports.threatray.com/aa8d43c8-bc94-4ef1-afc5-513a62d78ccf

Result

Malware family:

n/a

Score:

8/10

Tags:

collection credential_access defense_evasion discovery persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/261014-tv14aafx3t/

Behaviour

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Event Triggered Execution: Netsh Helper DLL

Reads the TCP/IP host and domain name from the registry

System Network Configuration Discovery: Wi-Fi Discovery

Accesses Microsoft Outlook profiles

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Modifies Windows Firewall

Unpacked files

SH256 hash:

f8fb4cb45e9e573bc6e0ad13ed90a36a0f363054ebca9d53fa5582207bdc6265

MD5 hash:

53262ea8f36c9ae7f8f4186b1654738d

SHA1 hash:

44d553348bab6048dd22d222face00225508f6de

Detections:

triage_airstalk

triage_plugx_rat

triage_scarlet_infostealer

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_DiscordURL

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/a1a10896-b258-4ea9-be4e-f24786c002e5/

SH256 hash:

cf5e709ee79c7ee80b2c9203070aa4de6f9db20263b0fe26d23e9bd999022dd9

MD5 hash:

abb7c85b1cea84b3b3bb98eae364b206

SHA1 hash:

8c3d5297e70ea35c957bbe358107005ce53c9823

Detections:

triage_plugx_rat

Link:

https://www.unpac.me/results/a1a10896-b258-4ea9-be4e-f24786c002e5/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f8fb4cb45e9e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f8fb4cb45e9e573bc6e0ad13ed90a36a0f363054ebca9d53fa5582207bdc6265

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_Dead_Family Create hunting rule
Author:	Your Name
Description:	YARA rule for detecting files related to dead.dll family

Rule name:	DotNet_RGB_Embedded_AssemblyLoader_Hunt Create hunting rule
Author:	ShadowOpCode
Description:	Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of MFA browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (https://www.lukeacha.com)
Description:	Generic detection for multiple RAT families, PUPs, packers and suspicious executables. NOTE: This rule may produce false positives. Updated May 2026 to reduce False Positives.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TelegramAPIMalware_PowerShell_EXE Create hunting rule
Author:	@polygonben
Description:	Hunting for pwsh malware using Telegram for C2

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TigerRAT_pe_yaraify Create hunting rule
Author:	hunts-yara-code
Description:	YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Malware_Unknown_ForgeAuto_43faefd2 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_f1079127 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/92053/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample