MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f697bff003f307c02bfa3b6ab53bd2632da609504e5fd2d5e4bd780f4743e49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1f697bff003f307c02bfa3b6ab53bd2632da609504e5fd2d5e4bd780f4743e49
SHA3-384 hash:	d51c9620633ee7785e3f453fba4ab40b1f6f7d0b69413748819fa15c505474535a8b0b89117e94523e2db8323d08279d
SHA1 hash:	2e6605672140a292ec475e441b156300a2d6a717
MD5 hash:	a7ec1450944e45525124cd409021dd42
humanhash:	maine-snake-connecticut-quebec
File name:	FHUOR 2 SAVE LOADER.exe
Download:	download sample
File size:	92'603'596 bytes
First seen:	2026-09-06 09:24:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (592 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	1572864:GDgi8msE+HU7yPlQrrAqKaiADkg1entaL5AFpeuPcz:G0ikUuJqKUD6s1AjeIcz
TLSH	T1D7183396FE25DC80C144C0BF65CD147659081FF829F8509A4C7DA8C4B8EBAC5FAE90BE
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	cc96f069e8c096d4
Reporter	Alex_sev
Tags:	electron exe infostealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

233

Origin country :

RO

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9a42d991-34b2-420f-818b-ffbf485c4a28/

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

FHUOR 2 SAVE LOADER.exe

Verdict:

Suspicious activity

Analysis date:

2026-08-28 09:58:42 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/eccfc731-d482-4840-8cef-3c2df0fefc51

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Searching for synchronization primitives

Unauthorized injection to a recently created process

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

DNS request

Connection attempt

Sending a custom TCP request

Loading a suspicious library

Deleting a recently created file

Adding an access-denied ACE

Creating a file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm base64 crypto crypto expand expired-cert fingerprint hacktool installer installer large-file lolbin microsoft_visual_cc nsis reconnaissance

Link:

https://www.filescan.io/uploads/6a9d322d9b9e74c0f1a1dab4/reports/0f384c80-6b7f-4178-91aa-1e4e796dac91/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/1f697bff003f307c02bfa3b6ab53bd2632da609504e5fd2d5e4bd780f4743e49

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x32

First seen:

2026-06-06T19:17:00Z UTC

Last seen:

2026-08-16T03:00:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1f697bff003f307c02bfa3b6ab53bd2632da609504e5fd2d5e4bd780f4743e49/results?tab=lookup

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/1f697bff003f307c02bfa3b6ab53bd2632da609504e5fd2d5e4bd780f4743e49

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-02 02:10:34 UTC

File Type:

PE (Exe)

Extracted files:

532

AV detection:

10 of 36 (27.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d5uxx7yah4yhyav7uo3kwu55eyznuyevats72lk6jplyb5duhzeq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

defense_evasion discovery execution spyware stealer themida trojan

Link:

https://tria.ge/reports/260906-leax6agq9w/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Checks whether UAC is enabled

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Themida packer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.