MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fa4070b5621914517362049ef967b47d8039fe30d5cffc95341ed489247a426. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OffLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fa4070b5621914517362049ef967b47d8039fe30d5cffc95341ed489247a426
SHA3-384 hash: b20b7e76d9fd958c1a0c9bebcb47f2ed2a17e9e5e9dac188ce693a57543f273ed9c8a111d257715954df46d59313231d
SHA1 hash: 3cd80643759767f8292144c2407f1ce9d24937eb
MD5 hash: 8456d267aebf338ed5fb5229ad8a8437
humanhash: don-august-saturn-timing
File name:FlClash-0.8.91-windows-amd64-setup.exe
Download: download sample
Signature OffLoader
Create hunting rule
File size:30'250'092 bytes
First seen:2025-12-30 23:49:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ac4ded70f85ef621e5f8917b250855be (31 x OffLoader, 3 x QuasarRAT, 2 x Tofsee)
ssdeep 393216:Q8zJrIeNESS702TnpuXdsjQKkMafApmuEW1eBGuIF5lIExVe2Ob/XDAB3KAz:pztIeNtCLpvkMmCeSxOrD4Zz
TLSH T1C2673333629A533EE4AB5B3B4AF6D2215D3B7751A50E8C6796E04C0CDF290600E7F693
TrID 60.0% (.EXE) Inno Setup installer (107240/4/30)
23.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
5.8% (.EXE) Win64 Executable (generic) (10522/11/4)
3.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Ling
Tags:exe Malgent OffLoader Trojan:Win32/Malgent!MSR


Avatar
Ling
This sample has been reviewed by Microsoft researchers and determined to be malware. (Trojan:Win32/Malgent!MSR)

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/2308814c-c71e-416e-a8df-e1841de63def/
Malware family:
n/a
ID:
1
File name:
FlClash-0.8.91-windows-amd64-setup.exe
Verdict:
No threats detected
Analysis date:
2025-12-18 13:29:10 UTC
Tags:
inno installer delphi
Link:
https://app.any.run/tasks/35c64052-c8e4-47af-ad64-67f6a5c4cddb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6954653fd2357cccc3de0d8a
Tags:
ransomware vmdetect virus sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug embarcadero_delphi fingerprint inno installer installer installer-heuristic lodarat overlay packed tofsee zero
Link:
https://www.filescan.io/uploads/6954653e127d6a14e0c940b8/reports/f2a0f7d4-41a2-414b-ab44-06053b6d8c06/overview
Verdict:
Malicious
Labled as:
Backdoor.Script.LodaRat.a
Link:
https://www.hybrid-analysis.com/sample/3fa4070b5621914517362049ef967b47d8039fe30d5cffc95341ed489247a426
Result
Gathering data
Verdict:
Clean
File Type:
exe x32
First seen:
2025-12-12T04:27:00Z UTC
Last seen:
2025-12-30T20:30:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/3fa4070b5621914517362049ef967b47d8039fe30d5cffc95341ed489247a426/results?tab=lookup
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3fa4070b5621914517362049ef967b47d8039fe30d5cffc95341ed489247a426
Gathering data
Verdict:
Clean
Link:
https://tip.neiki.dev/file/3fa4070b5621914517362049ef967b47d8039fe30d5cffc95341ed489247a426
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2025-12-12 11:03:32 UTC
File Type:
PE (Exe)
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h6saoc2wegiukfzwebe67ft3i7mahh7dbvop7sktihwureshuqta._file
Gathering data
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fbf48864-0dce-4535-95f7-6de785003dca
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3fa4070b5621914517362049ef967b47d8039fe30d5cffc95341ed489247a426

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OffLoader

Executable exe 3fa4070b5621914517362049ef967b47d8039fe30d5cffc95341ed489247a426

(this sample)

  
Delivery method
Distributed via web download

Comments