MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d80b98eef771c5419e2e56634d93e9899bbb077f0ff6fbd6892ef775535bd65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6d80b98eef771c5419e2e56634d93e9899bbb077f0ff6fbd6892ef775535bd65
SHA3-384 hash:	e5d01544fb8404a3e2b5ba836b4e453b8a2bcd4675cf92ec929c2461a9cf1a73bf02284b0a7e1c10dc988181f0fd665f
SHA1 hash:	9400090a512c992d2d23e9b682b7f3edf15fef8d
MD5 hash:	cabed9fd51e2a22b718754f2eb2c1b70
humanhash:	artist-diet-east-ten
File name:	SecuriteInfo.com.DecompressionBomb.74155745
Download:	download sample
File size:	89'740'667 bytes
First seen:	2025-09-13 21:35:56 UTC
Last seen:	2025-09-13 22:31:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (525 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:UO18kg6sfGuugeW9nngivgNZqlfLHWH8dF8aoUBafUHN9SM:UO18v1Gu9H5TTW0qaoU4cnSM
TLSH	T1171833966C94E07AD492667EE7C0071157FC7A7B9A3345C00A78CB563E880E4FB4EBE1
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

208

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

SecuriteInfo.com.DecompressionBomb.74155745

Verdict:

Malicious activity

Analysis date:

2025-09-13 21:37:41 UTC

Tags:

github auto-sch discord stealer arch-html arch-doc python arch-scr nodejs

Link:

https://app.any.run/tasks/9c163182-36b0-4b2f-b55b-e7f4c1463fc6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68c5e3fcd49ea3f1e4b54b53

Tags:

autorun shell sage blic

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Creating a window

Searching for the window

Searching for the Windows task manager window

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Creating a file

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Searching for synchronization primitives

Unauthorized injection to a recently created process

Loading a suspicious library

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole fingerprint installer microsoft_visual_cc nsis overlay packed

Link:

https://www.filescan.io/uploads/68c5e3eedbc6f5a29c43a61f/reports/fbab961f-9b4a-4e6d-a289-e7b2916a9f27/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6d80b98eef771c5419e2e56634d93e9899bbb077f0ff6fbd6892ef775535bd65

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

exe x32

First seen:

2025-09-13T23:35:00Z UTC

Last seen:

2025-09-13T23:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/6d80b98eef771c5419e2e56634d93e9899bbb077f0ff6fbd6892ef775535bd65/results?tab=lookup

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nwaltdxpo4ofigpc4vtdjwj6tcm3xmdx6d7w7plislxxovjvxvsq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

credential_access defense_evasion discovery execution persistence pyinstaller spyware stealer

Link:

https://tria.ge/reports/250913-1f89nsgr2t/

Behaviour

Kills process with taskkill

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Enumerates processes with tasklist

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e6575fa1-e59f-41cf-8666-ffc625ec6fc2

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6d80b98eef771c5419e2e56634d93e9899bbb077f0ff6fbd6892ef775535bd65