MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01f386dacff50f5d4ed9b7fbf5bdece92d2f85f8ba3e0cc21b9c866a3d7b3ad1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	01f386dacff50f5d4ed9b7fbf5bdece92d2f85f8ba3e0cc21b9c866a3d7b3ad1
SHA3-384 hash:	c1750eaff535b1e49698bac3bfc85411b0518dafd5bdcb79950bbdc74de497b1a5e0cefa445de6b6580f06a9ed00e8e0
SHA1 hash:	9e06d21588bfe02328e6bef886813d145193c407
MD5 hash:	0193748c38a7853e7eedcde580c341f6
humanhash:	single-music-double-single
File name:	Launcher.exe
Download:	download sample
Signature	DogeStealer Alert Create hunting rule
File size:	76'939'153 bytes
First seen:	2025-08-11 11:26:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	27f8a075898c0342804ab1dcef6774de (1 x DogeStealer)
ssdeep	393216:2QzE8nqWFK/2Cb4OF1UBTKY0kiwQE6nLr8JJhwQSI8wxSvDazn1N5VRBQiMdv8/x:2kqqwQtRPPVVKFDWhvxOtxrWU8btymP1
TLSH	T18CF77B4267EA04C5F9F7AA3489E65213D673BC067F3086DB324C172A1F736E09976722
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
dhash icon	e0e0d0c8fcdcdc9e (1 x DogeStealer)
Reporter	burger
Tags:	DogeStealer exe stealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

105

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6899d373c633abe3908dd13d

Tags:

shell virus sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a process from a recently created file

Creating a file

Deleting a recently created file

Connection attempt to an infection source

Sending a TCP request to an infection source

DNS request

Connection attempt

Sending a custom TCP request

Launching a service

Creating a window

Launching the default Windows debugger (dwwin.exe)

Query of malicious DNS domain

Unauthorized injection to a recently created process

Adding an exclusion to Microsoft Defender

Hybrid Analysis Malware/Generic

Verdict:

Suspicious

Labled as:

Malware/Generic

Link:

https://www.hybrid-analysis.com/sample/01f386dacff50f5d4ed9b7fbf5bdece92d2f85f8ba3e0cc21b9c866a3d7b3ad1

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

phis.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1754533

Signature

Adds a directory exclusion to Windows Defender

AI detected malicious Powershell script

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Overwrites Mozilla Firefox settings

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Check external IP via Powershell

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Uses attrib.exe to hide files

Uses cmd line tools excessively to alter registry or file data

Yara detected NexeCompiled Binary

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

52%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/01f386dacff50f5d4ed9b7fbf5bdece92d2f85f8ba3e0cc21b9c866a3d7b3ad1

CERT.PL MWDB

Gathering data

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/01f386dacff50f5d4ed9b7fbf5bdece92d2f85f8ba3e0cc21b9c866a3d7b3ad1

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-08-11 11:26:40 UTC

File Type:

PE+ (Exe)

Extracted files:

46

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ahzynwwp6uhv2twzw757lppm5ews7bpyxi7azqq3tsdgupl3hliq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution

Link:

https://tria.ge/reports/250811-nkr5qs1p15/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Drops file in Program Files directory

Drops file in Windows directory

Enumerates processes with tasklist

Hide Artifacts: Hidden Files and Directories

Looks up external IP address via web service

Maps connected drives based on registry

Checks computer location settings

Executes dropped EXE

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/773ece6e-cb34-4ee1-8efd-5b2e1e468711

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.