MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ff4fae33e6a418fd9df12e38b40c8d51370d0c2d45a6e8685e8e816fb237d33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0ff4fae33e6a418fd9df12e38b40c8d51370d0c2d45a6e8685e8e816fb237d33
SHA3-384 hash:	a6ed071d9c936ca50d8d370b2281b983255b5e78d61555c020bc07264e05d585d4b56d440e8939febdf8ea828139a4b4
SHA1 hash:	0661f66ba05059e853cdc6951a36974f027d5d58
MD5 hash:	916c15869a4d43c72e063dd104466abc
humanhash:	leopard-carolina-blossom-angel
File name:	Launcher.exe
Download:	download sample
File size:	117'363'461 bytes
First seen:	2026-10-31 03:35:44 UTC
Last seen:	2026-10-31 03:47:32 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	9eba512b03d8cac8a6c4424e25e9f06e (7 x FrostStealer, 2 x MythStealer, 1 x CoinMiner)
ssdeep	1572864:1Pp36F/iKRzNo0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZX:1PpIlNheuXpX/z/5NivOcC7hlTrd
TLSH	T12748F01663E111AAD577D138C7AB6603EB72B40713308BDB329C43652F73AE45E7AB60
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	f89efcf8f971f2e0 (10 x NodeLoader, 9 x FixStealer, 6 x Amadey)
Reporter	josie
Tags:	exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

29

Origin country :

US

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae599e3b121dd519dcf0373

Tags:

xtreme shell sage

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0ff4fae33e6a418fd9df12e38b40c8d51370d0c2d45a6e8685e8e816fb237d33

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-31T02:15:00Z UTC

Last seen:

2026-10-31T22:10:00Z UTC

Hits:

~1000

Detections:

Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/0ff4fae33e6a418fd9df12e38b40c8d51370d0c2d45a6e8685e8e816fb237d33/results?tab=lookup

Nucleon Malprob Malware

Score:

88%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/0ff4fae33e6a418fd9df12e38b40c8d51370d0c2d45a6e8685e8e816fb237d33

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b72pvyz6njay7wo7clrywqgi2ujxbugc2rng5buf5dubn6zdpuzq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/261031-jdvj3awt7j/

Behaviour

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Executes a command shell one-liner

Checks for VirtualBox DLLs, possible anti-VM trick

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.