MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 226049ccea0420c6ce9cbbc9254adcd1289d4ece7c7b5349fe01831735dc87d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	226049ccea0420c6ce9cbbc9254adcd1289d4ece7c7b5349fe01831735dc87d3
SHA3-384 hash:	b00190c1eab0b9329655e3b85fc5ac8930141254d2915f17df62a1cd76b4e87ec84deae98dcc0ea02170d8102f693ca2
SHA1 hash:	a7714fc6b04e8406b08593c3d78c687339950994
MD5 hash:	e405f4117ddeb3dd5ff58be416f2171c
humanhash:	south-fanta-cola-summer
File name:	SogouExplorer_Setup_x64_2100120000.exe
Download:	download sample
File size:	166'367'263 bytes
First seen:	2026-11-14 16:30:35 UTC
Last seen:	2026-11-14 17:22:09 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	efd455830ba918de67076b7c65d86586 (108 x Gh0stRAT, 23 x ValleyRAT, 6 x OffLoader)
ssdeep	3145728:1jGMpThspmpYmqC+94sTo2dGIPZ8lINAOfX/8FT+siWdpZU:EMpT8mpGC+6s5HeuNzfET+sd7U
TLSH	T12C883367AD877937E17E553A9CABF253243B6690E912882FD6F10008CF560D52C3E7A3
TrID	61.4% (.EXE) Inno Setup installer (107240/4/30) 23.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 3.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.7% (.EXE) Win64 Executable (generic) (6522/11/2) 2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	f08c33d89aa66430
Reporter	Ling
Tags:	Cybercrime exe SilverFox ValleyRAT

CNGaoLing

SilverFox / Cybercrime
IOC (Domain 103-2laiuufafa.com) (IP 103.214.172.16:443)

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

196

Origin country :

FR

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af88cf8fc945c1ebf2a18fd

Tags:

n/a

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/226049ccea0420c6ce9cbbc9254adcd1289d4ece7c7b5349fe01831735dc87d3

Nucleon Malprob Benign

Score:

26%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/226049ccea0420c6ce9cbbc9254adcd1289d4ece7c7b5349fe01831735dc87d3

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ejqetthkaqqmntu4xpesksw42euj2twopr5vgsp6agbrono4q7jq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery installer

Link:

https://tria.ge/reports/261114-t1h5naft5k/

Behaviour

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

System Location Discovery: System Language Discovery

Executes dropped EXE

VirusSign cont

Malware Family:

cont

Alert

Create hunting rule

Malicious:

True

Tags:

exe file-overlay

Link:

https://intel.virussign.com/intelligence/file/226049ccea0420c6ce9cbbc9254adcd1289d4ece7c7b5349fe01831735dc87d3

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.