MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 430b7b1a40143e04e84378b7d14936c6ae6dedd33fac2cad461d9b98b42ca2e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	430b7b1a40143e04e84378b7d14936c6ae6dedd33fac2cad461d9b98b42ca2e7
SHA3-384 hash:	07a4f4bef7c58993cc5732089027264b8921164e50fafd67ec637e250809b9dcfd9d986022be38dd841f051bd7edd617
SHA1 hash:	3acd9c389f86eee9564ecac32f72375e0923e600
MD5 hash:	fecb9f83da1c1521e675616efb40c3c3
humanhash:	five-aspen-violet-maryland
File name:	430b7b1a40143e04e84378b7d14936c6ae6dedd33fac2cad461d9b98b42ca2e7
Download:	download sample
File size:	97'882'112 bytes
First seen:	2026-08-05 12:45:28 UTC
Last seen:	2026-08-05 13:27:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fd6f6d07cc33ee9a2b65bda58a07bb94 (10 x NWHStealer)
ssdeep	1572864:WZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:WZa7hmguP2nUOnAwby
TLSH	T113286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11
TrID	55.7% (.WLX) Total Commander Lister extension (plugin) (21500/1/6) 16.9% (.EXE) Win64 Executable (generic) (6522/11/2) 11.6% (.EXE) Win32 Executable (generic) (4504/4/1) 5.2% (.EXE) OS/2 Executable (generic) (2029/13) 5.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	9170cc9296cc7001 (10 x NWHStealer, 1 x XWorm)
Reporter	adrian__luca
Tags:	exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

186

Origin country :

HU

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-08-05 12:51:34 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5483958b-2e98-4168-aa5c-72d85fa4c278

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a file in the Windows subdirectories

DNS request

Connection attempt

Sending a custom TCP request

Query of malicious DNS domain

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug fingerprint obfuscated overlay packed reconnaissance rust

Link:

https://www.filescan.io/uploads/6a733083f0d328b44bda1298/reports/c12d8a29-4215-4f79-832e-a3b1bf3446f8/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/430b7b1a40143e04e84378b7d14936c6ae6dedd33fac2cad461d9b98b42ca2e7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-29T21:39:00Z UTC

Last seen:

2026-07-29T21:55:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/430b7b1a40143e04e84378b7d14936c6ae6dedd33fac2cad461d9b98b42ca2e7/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/430b7b1a40143e04e84378b7d14936c6ae6dedd33fac2cad461d9b98b42ca2e7

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Miner

Threat name:

Win64.Trojan.Miner

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-30 08:25:16 UTC

File Type:

PE+ (Exe)

Extracted files:

14

AV detection:

4 of 36 (11.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=imfxwgsacq7aj2cdpc35csjwy2xg33oth6wczlkgdwnzrnbmultq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/260805-pzk6eagj9z/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Looks up external IP address via web service

Maps connected drives based on registry

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.