MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 396de2a468f40b6ac136d40590343ccaa9a6151ad7654eb1db090926694260af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	396de2a468f40b6ac136d40590343ccaa9a6151ad7654eb1db090926694260af
SHA3-384 hash:	d7f1651e1cda98d0aed7ad35f27555fa5bee2f0c740bffbbd48b89bea07ce742aa98fce6f1aa247b1e5a2adb2852ac46
SHA1 hash:	d0c3f8664ae8e476784809a96873e6bcc2216d72
MD5 hash:	e0a2ed2f81ddc4e2aafa1c47a7c73a17
humanhash:	violet-lactose-fourteen-bluebird
File name:	Vũ_Manager.exe
Download:	download sample
Signature	ScarfaceStealer Alert Create hunting rule
File size:	86'373'036 bytes
First seen:	2026-01-09 13:29:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	764090509664248d5254caeebe1e7af5 (2 x ScarfaceStealer, 1 x NodeLoader)
ssdeep	786432:8lI33vITTYy/5AYtzT/9tf6QvpgPVlcm2wu:D33QTTYA6V0
TLSH	T1D1187B5263FA09D6E9FB9A3489E65213D633BC062F3086DF324C176A1F736E04976721
TrID	48.7% (.EXE) Win64 Executable (generic) (10522/11/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
dhash icon	e09cece892c06298 (1 x ScarfaceStealer)
Reporter	burger
Tags:	exe ScarfaceStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

1'115

Origin country :

NL

Vendor Threat Intelligence

ACCE MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/68434deb-a467-447b-9e10-1a14e870ca69/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

V_Manager.exe

Verdict:

No threats detected

Analysis date:

2026-01-09 13:29:08 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/05298011-371b-4871-9e96-f5cf49ae71e4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=696102ab9922425f92ff2c8c

Tags:

virus

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug crypto fingerprint installer-heuristic microsoft_visual_cc nexe overlay packed packed

Link:

https://www.filescan.io/uploads/696102c107ef5fa68e82b476/reports/e062f71d-aa5b-44fb-b159-b867b7e1b8d4/overview

Hybrid Analysis Trojan.Win64.Genus

Verdict:

Malicious

Labled as:

Trojan.Win64.Genus

Link:

https://www.hybrid-analysis.com/sample/396de2a468f40b6ac136d40590343ccaa9a6151ad7654eb1db090926694260af

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x64

First seen:

2026-01-09T10:43:00Z UTC

Last seen:

2026-01-09T16:30:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/396de2a468f40b6ac136d40590343ccaa9a6151ad7654eb1db090926694260af/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1847276

Signature

Multi AV Scanner detection for submitted file

Yara detected NexeCompiled Binary

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/396de2a468f40b6ac136d40590343ccaa9a6151ad7654eb1db090926694260af

CERT.PL MWDB

Gathering data

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/396de2a468f40b6ac136d40590343ccaa9a6151ad7654eb1db090926694260af

ReversingLabs TitaniumCloud Win64.Malware.Heuristic

Threat name:

Win64.Malware.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-01-07 23:22:51 UTC

File Type:

PE+ (Exe)

Extracted files:

9

AV detection:

6 of 24 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hfw6fjdi6qfwvqjw2qczanb4zku2mfi225su5mo3beesm2kcmcxq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260109-qrkqcacx8d/

Behaviour

Checks processor information in registry

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b621b9df-f4a6-450f-bea8-3dd6576020b9

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.