Shaderify 8.4.4.exe

Classification: Malicious

Shaderify 8.4.4.exe is a malicious file sample. Reported by 2 threat sources, last seen 2024-06-22. Detected by 37 antivirus engines.

Detection summary

  • 37 antivirus detections
  • 1 IDS alerts
  • 32 processes observed
  • 2 contacted hosts
  • 2 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Easy Stealer ThreatFox Abuse.ch 2024-06-20 15:47:53 2024-06-22 15:30:32
Generic Malware Hybrid-Analysis 2024-06-19 23:45:03 2024-06-20 01:30:11

Tags

evasive win.easystealer

Sample information

Filenames
Shaderify 8.4.4.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows, ...
Size
56722770 bytes
MD5
1462794d394a8754380017d24338fcb1
SHA-1
4ae1c5f88b189386ea550cd85b15aaffcdda80ec
SHA-256
b5a30949b3eb0465a767e2f5f8b1e1a8b8bf805e820745e97ce0bfe43607da31
First indexed
2024-06-19 23:29:58
Last updated
2026-09-03 01:04:12

Antivirus detections

EngineDetection
BkavW32.AIDetectMalware
McAfeeDti!B5A30949B3EB
Paloaltogeneric.ml
Trapminemalicious.moderate.ml.score
ALYacQD:Trojan.GenericKDQ.72571EFA6E
AVGWin32:Evo-gen [Trj]
AlibabaTrojanPSW:Win32/Disco.8fa26c32
ArcabitQD:Trojan.GenericQ.72571EFA6E
AvastWin32:Evo-gen [Trj]
AviraTR/AVI.Agent.zlvrz
BitDefenderQD:Trojan.GenericKDQ.72571EFA6E
CAT-QuickHealTrojan.Ghanarava.172972057238fcb1
CTXexe.trojan.disco
CrowdStrikewin/malicious_confidence_100% (W)
DeepInstinctMALICIOUS
ESET-NOD32JS/Agent.RTP
EmsisoftQD:Trojan.GenericKDQ.72571EFA6E (B)
F-SecureTrojan.TR/AVI.Agent.zlvrz
FireEyeQD:Trojan.GenericKDQ.72571EFA6E
FortinetJS/Agent.RTP!tr
GDataQD:Trojan.GenericKDQ.72571EFA6E
GoogleDetected
K7AntiVirusTrojan ( 005b73ae1 )
K7GWTrojan ( 005b73ae1 )
KasperskyTrojan-PSW.Win32.Disco.wxu
KingsoftWin32.Trojan-PSW.Disco.wxu
LionicTrojan.Win32.Disco.i!c
MaxSecureTrojan.Malware.316774254.susgen
MicroWorld-eScanQD:Trojan.GenericKDQ.72571EFA6E
MicrosoftPWS:Win32/Disco!MSR
SkyhighArtemis
SophosMal/Generic-S
SymantecTrojan.Gen.MBT
TencentWin32.Trojan-QQPass.QQRob.Dplw
VBA32TrojanPSW.Crunexy
VaristW32/ABTrojan.POTN-4473
VirITTrojan.Win32.NSISDrp.GVS

Network contacts

172.67.187.227 104.26.13.205

DNS requests

api.ipify.org bettershaders.xyz

Process list

NameCommand line
Shaderify8.4.4.exe
Shaderify.exe
cmd.exe/d /s /c "wmic csproduct get uuid"
WMIC.exewmic csproduct get uuid
cmd.exe/d /s /c "tasklist"
tasklist.exe
cmd.exeC:\WINDOWS\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,124,25,212,5,104,57,253,66,166,205,247,133,83,181,13,251,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,170,109,225,203,187,33,3,112,242,102,242,229,213,145,144,243,158,223,138,173,133,242,221,96,3,196,115,136,1,190,229,155,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,185,98,128,17,219,169,8,140,194,180,241,163,198,252,41,85,63,42,39,34,168,16,217,164,17,23,57,252,155,127,194,72,48,0,0,0,255,238,187,156,55,13,132,226,222,54,29,102,28,107,117,237,126,21,111,133,233,170,102,246,32,113,242,85,239,55,246,47,93,203,25,232,166,14,101,6,255,162,29,151,4,145,197,134,64,0,0,0,31,213,194,237,145,31,134,223,152,142,193,115,12,140,214,52,71,137,167,172,118,42,25,65,0,102,110,195,98,220,45,37,34,248,57,18,23,204,128,158,202,210,66,225,42,250,117,80,69,237,73,145,30,71,191,184,61,233,205,240,26,139,96,116), $null, 'CurrentUser')"
powershell.exeAdd-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,124,25,212,5,104,57,253,66,166,205,247,133,83,181,13,251,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,170,109,225,203,187,33,3,112,242,102,242,229,213,145,144,243,158,223,138,173,133,242,221,96,3,196,115,136,1,190,229,155,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,185,98,128,17,219,169,8,140,194,180,241,163,198,252,41,85,63,42,39,34,168,16,217,164,17,23,57,252,155,127,194,72,48,0,0,0,255,238,187,156,55,13,132,226,222,54,29,102,28,107,117,237,126,21,111,133,233,170,102,246,32,113,242,85,239,55,246,47,93,203,25,232,166,14,101,6,255,162,29,151,4,145,197,134,64,0,0,0,31,213,194,237,145,31,134,223,152,142,193,115,12,140,214,52,71,137,167,172,118,42,25,65,0,102,110,195,98,220,45,37,34,248,57,18,23,204,128,158,202,210,66,225,42,250,117,80,69,237,73,145,30,71,191,184,61,233,205,240,26,139,96,116), $null, 'CurrentUser')
cmd.exeC:\WINDOWS\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,35,135,27,63,99,50,17,68,169,47,240,42,181,125,111,40,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,137,12,25,44,200,16,97,0,125,222,55,8,245,167,201,198,60,115,250,75,117,201,216,123,45,60,216,215,90,68,49,192,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,222,28,181,216,109,95,154,24,195,59,229,168,235,2,3,126,122,206,123,46,253,27,15,127,153,226,221,24,75,6,233,79,48,0,0,0,70,135,227,75,52,37,82,46,167,246,27,0,241,16,254,223,251,88,202,170,204,171,85,180,23,148,107,99,220,234,226,200,209,62,69,52,247,188,214,240,134,101,57,18,71,74,227,247,64,0,0,0,196,163,32,68,132,232,124,58,148,17,5,81,115,190,33,221,126,203,37,115,46,125,57,145,136,179,183,181,197,147,15,71,235,50,201,86,120,59,1,27,92,191,221,20,59,85,138,174,122,248,9,198,104,244,196,120,36,110,119,28,72,142,173,44), $null, 'CurrentUser')"
powershell.exeAdd-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,35,135,27,63,99,50,17,68,169,47,240,42,181,125,111,40,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,137,12,25,44,200,16,97,0,125,222,55,8,245,167,201,198,60,115,250,75,117,201,216,123,45,60,216,215,90,68,49,192,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,222,28,181,216,109,95,154,24,195,59,229,168,235,2,3,126,122,206,123,46,253,27,15,127,153,226,221,24,75,6,233,79,48,0,0,0,70,135,227,75,52,37,82,46,167,246,27,0,241,16,254,223,251,88,202,170,204,171,85,180,23,148,107,99,220,234,226,200,209,62,69,52,247,188,214,240,134,101,57,18,71,74,227,247,64,0,0,0,196,163,32,68,132,232,124,58,148,17,5,81,115,190,33,221,126,203,37,115,46,125,57,145,136,179,183,181,197,147,15,71,235,50,201,86,120,59,1,27,92,191,221,20,59,85,138,174,122,248,9,198,104,244,196,120,36,110,119,28,72,142,173,44), $null, 'CurrentUser')
cmd.exe/d /s /c "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "%ALLUSERSPROFILE%\edge\Updater\Get-Clipboard.ps1""
powershell.exe-WindowStyle Hidden -ExecutionPolicy Bypass -File "%ALLUSERSPROFILE%\edge\Updater\Get-Clipboard.ps1"
csc.exe/noconfig /fullpaths @"%TEMP%\1gsx1z3x\1gsx1z3x.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES92BA.tmp" "%TEMP%\1gsx1z3x\CSC523930D51F0D419F8D81F7F264A179A.TMP"
Shaderify.exe--type=gpu-process --field-trial-handle=2080,10795329764917250451,16541261900712023788,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
WerFault.exe-u -p 5624 -s 480
Shaderify.exe--type=gpu-process --field-trial-handle=2080,10795329764917250451,16541261900712023788,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2388 /prefetch:2
WerFault.exe-u -p 4664 -s 496
Shaderify.exe--type=gpu-process --field-trial-handle=2080,10795329764917250451,16541261900712023788,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
WerFault.exe-u -p 2784 -s 504
Shaderify.exe--type=gpu-process --field-trial-handle=2080,10795329764917250451,16541261900712023788,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2484 /prefetch:2
WerFault.exe-u -p 3352 -s 480
Shaderify.exe--type=gpu-process --field-trial-handle=2080,10795329764917250451,16541261900712023788,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2652 /prefetch:2
WerFault.exe-u -p 9908 -s 480
Shaderify.exe--type=gpu-process --field-trial-handle=2080,10795329764917250451,16541261900712023788,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2628 /prefetch:2
WerFault.exe-u -p 4016 -s 496
WerFault.exe-pss -s 220 -p 5624 -ip 5624
WerFault.exe-pss -s 220 -p 4664 -ip 4664
WerFault.exe-pss -s 220 -p 2784 -ip 2784
WerFault.exe-pss -s 444 -p 3352 -ip 3352