MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2dfeb337577ed2771289463990d6f5056b2271608a5b755d2db19559daa41b72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2dfeb337577ed2771289463990d6f5056b2271608a5b755d2db19559daa41b72
SHA3-384 hash:	d2a378b9dacf4d3d48c2e2ccfe8b006f5a6e7a934e147bb6ac31864af6042ee5baedf6e732a8a0d8d8efd404ea707e96
SHA1 hash:	0530ca032e03315942213f96e377d8889a234cc9
MD5 hash:	ae4690dbe3da05eea3548cf01f28dc2d
humanhash:	tennessee-gee-october-five
File name:	Nexora.exe
Download:	download sample
Signature	ScarfaceStealer Alert Create hunting rule
File size:	71'366'656 bytes
First seen:	2026-03-01 11:44:52 UTC
Last seen:	2026-03-01 13:03:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	772ec87d3452991a9933a3ba0d9963a9 (13 x ScarfaceStealer)
ssdeep	393216:Ln1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:L1XR7AsxYqt2oRGj5rs3wb8/
TLSH	T12AF7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	burger
Tags:	exe Rhadamanthys ScarfaceStealer

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

120

Origin country :

NL

Vendor Threat Intelligence

ACCE MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ecf187c5-4169-4080-b143-2bb3f8cfc561/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

Nexora.exe

Verdict:

No threats detected

Analysis date:

2026-03-01 11:45:11 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/fc27fbff-edfe-4b72-88cb-355cad1b0fd1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a4269f8fffa866e3b3b41d

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm crypto expand fingerprint lolbin microsoft_visual_cc

Link:

https://www.filescan.io/uploads/69a426e997feb4afd662822b/reports/503a9226-e3e2-424f-96e2-5b0a0528417b/overview

Hybrid Analysis Win64_Kryptik_GLN_trojan

Verdict:

Malicious

Labled as:

Win64_Kryptik_GLN_trojan

Link:

https://www.hybrid-analysis.com/sample/2dfeb337577ed2771289463990d6f5056b2271608a5b755d2db19559daa41b72

InQuest

Result

Gathering data

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x64

Link:

https://opentip.kaspersky.com/2dfeb337577ed2771289463990d6f5056b2271608a5b755d2db19559daa41b72/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1876462

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/2dfeb337577ed2771289463990d6f5056b2271608a5b755d2db19559daa41b72

CERT.PL MWDB

Gathering data

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/2dfeb337577ed2771289463990d6f5056b2271608a5b755d2db19559daa41b72

ReversingLabs TitaniumCloud Win64.Packed.Generic

Threat name:

Win64.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-02-28 22:00:35 UTC

File Type:

PE+ (Exe)

Extracted files:

8

AV detection:

4 of 36 (11.11%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fx7lgn2xp3jhoeujiy4zbvxvavvse4larjnxkxjnwgkvtwvednza._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/260301-nw5vzafs4h/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Obfuscated Files or Information: Command Obfuscation

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.