MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e167b5df8098eb17ba0f013e195137d588d5195d4d4448c8ad61d7dbafa6102. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0e167b5df8098eb17ba0f013e195137d588d5195d4d4448c8ad61d7dbafa6102
SHA3-384 hash:	97e763ff5ce2412683e5587ba0822c0580510866b7af7e30ff18da6b33e8186781762785030a759fefb28e8b228bd5db
SHA1 hash:	bf4ab8fb83098864e5effe97086405e6ed7896a7
MD5 hash:	ad9d4720ffcfde0ace1e1177664b3e53
humanhash:	virginia-carpet-tango-carbon
File name:	UnoPlay-Setup-1.0.0.exe
Download:	download sample
File size:	155'310'696 bytes
First seen:	2026-09-30 17:02:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (594 x GuLoader, 131 x RemcosRAT, 86 x EpsilonStealer)
ssdeep	3145728:WQ9PlbKnbBmpODvdddNdSeQAtP3lIRAdehjUrH05D7s1dpnrE/Lcp:BMSOjdnjP3lIadeH5WpnAwp
TLSH	T15F783362D7D0CDBAD336507B5382AF91D9691693CF0D07EB2A8134B8E3B27F71824196
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	be86e1aabafcaaa2
Reporter	NyxIndius
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

419

Origin country :

BR

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

playuno.me

Verdict:

Malicious activity

Analysis date:

2026-09-30 15:01:29 UTC

Tags:

stealer aegis discord xor-url generic evasion

Link:

https://app.any.run/tasks/6f52541b-d747-4cfa-bb26-864756c2b34c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ace78652e5d8a93d8150f48

Tags:

cobalt java

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Searching for the window

Searching for the Windows task manager window

Launching a service

Creating a file

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Searching for synchronization primitives

Unauthorized injection to a recently created process

Creating a process with a hidden window

Changing a file

Deleting a recently created file

DNS request

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0e167b5df8098eb17ba0f013e195137d588d5195d4d4448c8ad61d7dbafa6102

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-30T12:35:00Z UTC

Last seen:

2026-10-01T22:06:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0e167b5df8098eb17ba0f013e195137d588d5195d4d4448c8ad61d7dbafa6102/results?tab=lookup

Nucleon Malprob Benign

Score:

15%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/0e167b5df8098eb17ba0f013e195137d588d5195d4d4448c8ad61d7dbafa6102

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bylhwxpybghlc65a6aj6dfitpvmi2umv2tkejdek2yox3ox2meba._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/260930-vk55xsyycy/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Adds Run key to start application

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads ssh keys stored on the system

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Looks for VMWare Tools registry key

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 0e167b5df8098eb17ba0f013e195137d588d5195d4d4448c8ad61d7dbafa6102

(this sample)

any.run

https://app.any.run/tasks/2d724f63-3c31-42a0-8b53-8112379796d1/

  

URLhaus

https://urlhaus.abuse.ch/url/3925616/

  

Delivery method

Distributed via web download