MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cad181b2a0c10c287173b15efa7bf92d387987a41a49ad9be3c486e43e3ddc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0cad181b2a0c10c287173b15efa7bf92d387987a41a49ad9be3c486e43e3ddc2
SHA3-384 hash:	4d07b20d3a57bec207d8318629e0e353a08224ea50972a8ebb056525ff0af06be93f6236927cc5a5ddb225435a20400f
SHA1 hash:	9e9505c627a32109684fdf92492c91856b051fa6
MD5 hash:	ea673e77c29375d2c4a99f614ab7cb42
humanhash:	green-tennessee-bacon-bulldog
File name:	Setup.exe
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	81'787'320 bytes
First seen:	2026-08-26 18:16:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (594 x GuLoader, 131 x RemcosRAT, 86 x EpsilonStealer)
ssdeep	1572864:1LdkJKJhWFmN3YODFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7c7:12JKqgYWaABZVPArg/bXeB7c7
TLSH	T18108338047998669C18B6EF8607B1FF3AE1E5D80B21D50EF4AE78872F654C77C98C14B
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	Alex_sev
Tags:	electron exe infostealer vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

269

Origin country :

NL

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/8cd4aad1-9cb1-44a2-a8fd-5a21e1e9e1b1/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-08-26 18:29:26 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b9326d33-478b-4005-bbd6-f560e258fcc5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac3c75720ba0e2385cd4bce

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Running batch commands

Creating a process with a hidden window

Creating a file

Searching for synchronization primitives

Launching the process to interact with network services

Launching a process

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

DNS request

Connection attempt

Sending a custom TCP request

Forced system process termination

Deleting a recently created file

Using the Windows Management Instrumentation requests

Adding an exclusion to Microsoft Defender

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm base64 crypto crypto expand expired-cert fingerprint hacktool installer installer lolbin microsoft_visual_cc nsis obfuscated reconnaissance

Link:

https://www.filescan.io/uploads/6a8f2dac16424871e771d0a2/reports/e6d05d04-207d-4b9b-9011-37cf84d95b7c/overview

Hybrid Analysis Generik_KGOSRWF_trojan

Verdict:

Malicious

Labled as:

Generik_KGOSRWF_trojan

Link:

https://www.hybrid-analysis.com/sample/0cad181b2a0c10c287173b15efa7bf92d387987a41a49ad9be3c486e43e3ddc2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-08-26T16:41:00Z UTC

Last seen:

2026-08-26T17:09:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0cad181b2a0c10c287173b15efa7bf92d387987a41a49ad9be3c486e43e3ddc2/results?tab=lookup

Nucleon Malprob Malware

Score:

75%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/0cad181b2a0c10c287173b15efa7bf92d387987a41a49ad9be3c486e43e3ddc2

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bswrqgzkbqimfbyxhmk67j57sljypgd2igsjvwn6hreg4q7d3xba._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution trojan

Link:

https://tria.ge/reports/260826-ww6fhaef67/

Behaviour

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Hide Artifacts: Ignore Process Interrupts

Executes a VBScript file via the Windows Script Host.

Suspicious use of NtSetInformationThreadHideFromDebugger

Hide Artifacts: Hidden Window

Obfuscated Files or Information: Command Obfuscation

Executes dropped EXE

Loads dropped DLL

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

System Binary Proxy Execution: Rundll32

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Windows security bypass

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.