MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42f8b583b28f8f3ba2f9b884b4e36f94ca08387ca410d6135d3bf0960b9b35b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	42f8b583b28f8f3ba2f9b884b4e36f94ca08387ca410d6135d3bf0960b9b35b7
SHA3-384 hash:	2140f316ae757cfce923e9e627040ee7aba8379f7276e0b1b24a98d9870bdeada57d15c38f39bb05c2174030ae5b927d
SHA1 hash:	ef92d95f085e4cb84601fb4e2c85f1e213504f1f
MD5 hash:	bae3cb83fa83219e9483d0b37c766b23
humanhash:	angel-snake-winter-batman
File name:	42f8b583b28f8f3ba2f9b884b4e36f94ca08387ca410d6135d3bf0960b9b35b7
Download:	download sample
File size:	97'878'528 bytes
First seen:	2026-09-04 11:24:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fd6f6d07cc33ee9a2b65bda58a07bb94 (10 x NWHStealer)
ssdeep	1572864:qZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:qZa7hmguP2nUOnAwby
TLSH	T165286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11
TrID	55.7% (.WLX) Total Commander Lister extension (plugin) (21500/1/6) 16.9% (.EXE) Win64 Executable (generic) (6522/11/2) 11.6% (.EXE) Win32 Executable (generic) (4504/4/1) 5.2% (.EXE) OS/2 Executable (generic) (2029/13) 5.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	9170cc9296cc7001 (10 x NWHStealer, 1 x XWorm)
Reporter	adrian__luca
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

154

Origin country :

HU

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-04 11:39:59 UTC

Tags:

external-template

Link:

https://app.any.run/tasks/c853a756-1c4e-49af-b193-66eb59531a5a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the Windows subdirectories

DNS request

Connection attempt

Sending a custom TCP request

Launching a process

Reading critical registry keys

Creating a window

Сreating synchronization primitives

Creating a file in the Program Files subdirectories

Searching for synchronization primitives

Creating a file

Unauthorized injection to a recently created process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug fingerprint obfuscated overlay packed reconnaissance rust

Link:

https://www.filescan.io/uploads/6a9aaaa3c20c32592ab1ec11/reports/f5d527ed-5205-4d16-bcf7-ce8ddffbad36/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/42f8b583b28f8f3ba2f9b884b4e36f94ca08387ca410d6135d3bf0960b9b35b7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-04T09:26:00Z UTC

Last seen:

2026-09-04T09:59:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/42f8b583b28f8f3ba2f9b884b4e36f94ca08387ca410d6135d3bf0960b9b35b7/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/42f8b583b28f8f3ba2f9b884b4e36f94ca08387ca410d6135d3bf0960b9b35b7

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=il4lla5sr6htxixzxccljy3pstfaqod4uqinme25hpyjmc43gw3q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/260904-njgydahl3t/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Looks up external IP address via web service

Maps connected drives based on registry

Checks computer location settings

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/42f8b583b28f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.