MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18cb2495b5e0512f8026d7fd123ae821d554d918ecd7269e9b8eb40ca2f480cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	18cb2495b5e0512f8026d7fd123ae821d554d918ecd7269e9b8eb40ca2f480cc
SHA3-384 hash:	16350e56c23d49171783de685109cfa9a037d124634a1b1c5dcd516d62fb5486ca85a7f7fb4fc63f7832f117e9f9eecf
SHA1 hash:	32bca821f9d6ad6c4ed652b68d667ec2ba6e4c45
MD5 hash:	9945eeb90b702636b496e063fef0e339
humanhash:	floor-july-seventeen-quiet
File name:	99de081e-4602-4f77-a173-837ebfd30379
Download:	download sample
File size:	80'972'576 bytes
First seen:	2026-03-07 18:22:24 UTC
Last seen:	2026-03-07 19:39:41 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	88016fcdef7f227c62171d0afad9aae4 (5 x OffLoader, 3 x Gh0stRAT, 3 x ValleyRAT)
ssdeep	1572864:yD1PNHpD9LOIyiLGdYdOyJ0BCDKTpcgpyc0Gs+yUgxEhMFmmHIk8aYi+H:0FNF9LbyiuYFJ0sDwjpra+yUgksLl88O
TLSH	T13808333F6287552EF8AE1638753296205837AD7275074C6682E0E94CDF3A1706F3EB4B
TrID	50.8% (.EXE) Inno Setup installer (107240/4/30) 20.4% (.EXE) InstallShield setup (43053/19/16) 19.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 3.0% (.EXE) Win64 Executable (generic) (6522/11/2) 2.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	a2bebe9cfab3fa6c (1 x Stealc)
Reporter	SquiblydooBlog
Tags:	exe signed

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

206

Origin country :

US

Vendor Threat Intelligence

ACCE

Gathering data

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ac6cf6e41a5a0999309622

Tags:

vmdetect delphi

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

adaptive-context embarcadero_delphi expired-cert fingerprint inno installer installer installer-heuristic packed short-lived-cert signed soft-404

Link:

https://www.filescan.io/uploads/69ac6d1c97feb4afd672fa1b/reports/f36f4a45-d908-4370-8b32-d59272174df8/overview

Hybrid Analysis TrojanDldr.OffLoader.gen

Verdict:

Malicious

Labled as:

TrojanDldr.OffLoader.gen

Link:

https://www.hybrid-analysis.com/sample/18cb2495b5e0512f8026d7fd123ae821d554d918ecd7269e9b8eb40ca2f480cc

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

Detections:

Trojan.Win32.Alien.akdq HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/18cb2495b5e0512f8026d7fd123ae821d554d918ecd7269e9b8eb40ca2f480cc/results?tab=lookup

Nucleon Malprob Susipicious

Score:

35%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/18cb2495b5e0512f8026d7fd123ae821d554d918ecd7269e9b8eb40ca2f480cc

CERT.PL MWDB

Gathering data

Neiki Trojan.Win32.Alien

Verdict:

Malicious

Threat:

Trojan.Win32.Alien

Link:

https://tip.neiki.dev/file/18cb2495b5e0512f8026d7fd123ae821d554d918ecd7269e9b8eb40ca2f480cc

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ddfsjfnv4bis7abg276reoxiehkvjwiy5tlsnhu3r22azixuqdga._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

discovery execution installer

Link:

https://tria.ge/reports/260307-w1mtysbv6w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.