MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c5583fff213bd93237b110c274a7ceb8063dd7ee1d0b4fd38351e2975be5cee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7c5583fff213bd93237b110c274a7ceb8063dd7ee1d0b4fd38351e2975be5cee
SHA3-384 hash:	9db9c54da48c386fa39e72c57d506748c66d644020ee2ff0ed6fab8610d7a1b397e0af266dc1de1b60c2d92c183e3700
SHA1 hash:	f6d017240a311b4ff163e05f6339596b7fb69253
MD5 hash:	fe12eee0df4e6edff380588cd39aa3f9
humanhash:	nevada-salami-east-fifteen
File name:	NexBee Setup.exe
Download:	download sample
File size:	102'799'512 bytes
First seen:	2025-10-06 17:43:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (525 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:5eM0d+Aqu3V42SNWZqEr8E0Xqmeo4nVTei6WrEWXl+7GcCG3XGTURSrd1cF:53I+wKvErF0XvTwV166l+CcZns5iF
TLSH	T139383367A1864B51E44F6FB04A206C43046DAA1592307F12F76D5E8FB436F8F0C6DEEA
TrID	37.3% (.EXE) Win64 Executable (generic) (10522/11/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	smica83
Tags:	exe signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

105

Origin country :

HU

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

NexBeeSetup.exe

Verdict:

Malicious activity

Analysis date:

2025-10-06 17:44:19 UTC

Tags:

websocket arch-exec arch-doc nodejs

Link:

https://app.any.run/tasks/6eac1060-4da2-42c1-aeaf-c2b9ac907f82

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e3ffd5277c2bd8bc5cfbaa

Tags:

blic sage remo

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Creating a window

Searching for the window

Creating a file in the Program Files subdirectories

Creating a file

Creating a process from a recently created file

Searching for synchronization primitives

Unauthorized injection to a recently created process

Loading a suspicious library

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

DNS request

Sending a UDP request

Sending a custom TCP request

Adding an access-denied ACE

Enabling autorun with the shell\open\command registry branches

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole crypto fingerprint installer microsoft_visual_cc nsis overlay packed signed

Link:

https://www.filescan.io/uploads/68e3ffc65a3bccf09eba0d61/reports/284ec395-294a-459f-9fe5-1bb3b772c1fe/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7c5583fff213bd93237b110c274a7ceb8063dd7ee1d0b4fd38351e2975be5cee

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-08-04T09:50:00Z UTC

Last seen:

2025-10-07T00:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7c5583fff213bd93237b110c274a7ceb8063dd7ee1d0b4fd38351e2975be5cee/results?tab=lookup

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

n/a

Score:

36 / 100

Link:

https://www.joesandbox.com/analysis/1790013

Signature

Drops large PE files

Found pyInstaller with non standard icon

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

5%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/7c5583fff213bd93237b110c274a7ceb8063dd7ee1d0b4fd38351e2975be5cee

CERT.PL MWDB

Gathering data

Neiki Trojan.Win32.Agent

Verdict:

Malicious

Threat:

Trojan.Win32.Agent

Link:

https://tip.neiki.dev/file/7c5583fff213bd93237b110c274a7ceb8063dd7ee1d0b4fd38351e2975be5cee

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=prkyh77sco6zgi33cegcost45oaghxl64hilj7jygupcs5n6ltxa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution

Link:

https://tria.ge/reports/251006-wawzyatthz/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/38c5cceb-3439-4889-85c8-5225cc6a0275

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.