MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0454a0a78c6d3952a2c7c206c3d767b565636733061eab0bca35a67cf68fd818. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0454a0a78c6d3952a2c7c206c3d767b565636733061eab0bca35a67cf68fd818
SHA3-384 hash:	b9a83afc032f1f95f3690e94646b93432dfcfc6c34829b34dd750d870787618659c9efd670bf912b95a2f12cc8b028aa
SHA1 hash:	50612579ff4ec42de63e629552c0737d4bad4f8a
MD5 hash:	5901be37b5ecabc7b139faeec46ed8d3
humanhash:	texas-island-vegan-nineteen
File name:	MoviesParty.exe
Download:	download sample
File size:	154'956'576 bytes
First seen:	2026-09-23 20:41:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (594 x GuLoader, 131 x RemcosRAT, 86 x EpsilonStealer)
ssdeep	3145728:mVPl7u1r+5WdSeQAtP3lIRAzvehjUrH05B7s1Yg2puFZWE/LcJ:W+DjP3lIaDeH5ZgEuLwJ
TLSH	T10878336253F2DAAAD337847743937F74BA3103D2DE08055E6ED074B5AAA03DF682446E
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	10ccccf0d4ccaa00
Reporter	nextpro
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

265

Origin country :

US

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6acdc273853d431abd4dac1a

Tags:

injection virus java blic

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Searching for the window

Creating a file

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Deleting a recently created file

Unauthorized injection to a recently created process

Searching for synchronization primitives

Loading a suspicious library

Creating a process with a hidden window

DNS request

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0454a0a78c6d3952a2c7c206c3d767b565636733061eab0bca35a67cf68fd818

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x32

Link:

https://opentip.kaspersky.com/0454a0a78c6d3952a2c7c206c3d767b565636733061eab0bca35a67cf68fd818/results?tab=lookup

Nucleon Malprob Benign

Score:

11%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/0454a0a78c6d3952a2c7c206c3d767b565636733061eab0bca35a67cf68fd818

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Exploit.CVE-2012-0507

Threat name:

Win32.Exploit.CVE-2012-0507

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-23 20:43:27 UTC

File Type:

PE (Exe)

Extracted files:

9829

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=arkkbj4mnu4vfiwhyidmhv3hwvswgzztaypkwc6kgwthz5up3ama._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/260923-zg6phace35/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Adds Run key to start application

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads ssh keys stored on the system

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Looks for VMWare Tools registry key

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.