MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15ffd51e38471d043bb3de196d8d2d73e1b195a6e1429a7a9f0f2fc0a9fc6512. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	15ffd51e38471d043bb3de196d8d2d73e1b195a6e1429a7a9f0f2fc0a9fc6512
SHA3-384 hash:	d7fddea467e452a69dbb0c6764522f60730729a0ea18a18b8e8e9caca4c98e3769fda69a154f59c351c572be0f8a760d
SHA1 hash:	41c6ed29e98422f3d61500b5cc1523e3dc9a5390
MD5 hash:	92d47439724f548551bebe77fa713d39
humanhash:	five-washington-cardinal-high
File name:	setup.exe
Download:	download sample
File size:	91'043'737 bytes
First seen:	2026-09-27 14:09:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (593 x GuLoader, 130 x RemcosRAT, 85 x EpsilonStealer)
ssdeep	1572864:vBu/U1RESsuvQDqN7FxiD39Y3b1+ga+24UOIOxXZNJhGcYGsIE1Kx2sKgj:vBqkKw0Y3kgRMANJ/sIEA9
TLSH	T1C31833BB3B924C72FC5D4A30FB0658A8647BEEB382C44D6ABB0DD0AA50705D605F157E
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	2896969696969668 (2 x NyxStealer)
Reporter	Anonymous
Tags:	exe NyxStealer RAT stealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

367

Origin country :

US

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3b999a40-6b12-4514-ae11-b82166d9150d/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-27 14:24:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/bec4eec3-b3d7-49ac-884b-599676e58443

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Searching for the window

Creating a file

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Creating a process from a recently created file

Creating a window

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context adaptive-context anti-debug crypto fingerprint installer installer installer-heuristic microsoft_visual_cc nsis packed reconnaissance

Link:

https://www.filescan.io/uploads/6ab923a89460069d29914895/reports/0bcb72f6-e1e4-4dc9-9a16-0543d2da926b/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/15ffd51e38471d043bb3de196d8d2d73e1b195a6e1429a7a9f0f2fc0a9fc6512

Nucleon Malprob Susipicious

Score:

68%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/15ffd51e38471d043bb3de196d8d2d73e1b195a6e1429a7a9f0f2fc0a9fc6512

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cx75khryi4oqio5t3ymw3djnopq3dfng4fbju6u7b4x4bkp4muja._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution spyware stealer

Link:

https://tria.ge/reports/260927-rgjkzazcnc/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.