MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0216cb36bd5b8620185e546f14aab7e8af29da33ba3e4be24997461be26320da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0216cb36bd5b8620185e546f14aab7e8af29da33ba3e4be24997461be26320da
SHA3-384 hash:	4873bff70a2229acba26c343595c39c7261a706b3892dbad6eac037e934c3916f17b3ffeb00e592b3b101317fd0065c3
SHA1 hash:	5aa334f7951c4a0ce693cd30eda8abb3b47f1a15
MD5 hash:	f0c0476b40083570b9de80c7b5af2b24
humanhash:	oven-nineteen-fanta-wisconsin
File name:	releasecore-x64.exe
Download:	download sample
File size:	92'055'066 bytes
First seen:	2026-08-27 18:42:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (592 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	1572864:MLdkR5PvTZb8WtytzfrYxVy9IHFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7n7:M2jvTdXty18Vy4aABZVPArg/bXeB7n7
TLSH	T1D518338446618254D1CFBEF8653B0FE3AE764EE0676D50BF46A38C72F5A007AD49C24B
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	Alex_sev
Tags:	electron exe infostealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

250

Origin country :

RO

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3d4deba2-4e80-48d6-b335-43685c0f4367/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-08-27 18:50:33 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e2f20f05-65e3-465f-8ff4-a80c7cbd8eec

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Running batch commands

Creating a process with a hidden window

Creating a file

Searching for synchronization primitives

DNS request

Launching the process to interact with network services

Forced system process termination

Launching a process

Connection attempt

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm base64 crypto crypto expand expired-cert fingerprint hacktool installer installer lolbin microsoft_visual_cc nsis obfuscated reconnaissance

Link:

https://www.filescan.io/uploads/6a90854577b9aed32257d1f9/reports/735e2a61-9638-441d-9144-c226cfa907dc/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0216cb36bd5b8620185e546f14aab7e8af29da33ba3e4be24997461be26320da

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-08-19T17:07:00Z UTC

Last seen:

2026-08-19T17:27:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0216cb36bd5b8620185e546f14aab7e8af29da33ba3e4be24997461be26320da/results?tab=lookup

Nucleon Malprob Malware

Score:

79%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/0216cb36bd5b8620185e546f14aab7e8af29da33ba3e4be24997461be26320da

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ailmwnv5lodcagc6krxrjkvx5cxstwrtxi7exysjs5dbxytdedna._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution trojan

Link:

https://tria.ge/reports/260827-xc25eacq3v/

Behaviour

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Hide Artifacts: Ignore Process Interrupts

Executes a VBScript file via the Windows Script Host.

Hide Artifacts: Hidden Window

Looks up external IP address via web service

Obfuscated Files or Information: Command Obfuscation

Executes dropped EXE

Loads dropped DLL

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

Command and Scripting Interpreter: PowerShell

Windows security bypass

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0216cb36bd5b8620185e546f14aab7e8af29da33ba3e4be24997461be26320da