MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4503fe5a9a97249fb92441419b29b21eb52f737b42cfb37cffa5bb8bd55cc356. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4503fe5a9a97249fb92441419b29b21eb52f737b42cfb37cffa5bb8bd55cc356
SHA3-384 hash:	28a395ce4f928400f05959f2ca9a7e56546d6290f0b0bd02dac14f86d4e7e7d04e321dc5a4de9c296aff6c68bef6bc8d
SHA1 hash:	568e24ad3ec27533217e82432ad279d2407f9923
MD5 hash:	27a37b13bf856da9ad1763acdc742d47
humanhash:	glucose-march-spaghetti-lamp
File name:	file
Download:	download sample
Signature	ScarfaceStealer Alert Create hunting rule
File size:	90'256'896 bytes
First seen:	2026-05-24 00:44:46 UTC
Last seen:	2026-05-24 00:46:30 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9bf3f5698d1c8e5d8bbe8d194ac5d544 (49 x ScarfaceStealer)
ssdeep	786432:1AZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXWc:1AZui3zQz2jOZKft
TLSH	T126187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	9c98f8f8b0b0c480 (1 x ScarfaceStealer)
Reporter	Bitsight
Tags:	54e64e dropped-by-amadey exe ScarfaceStealer

Bitsight

url: http://91.92.242.236/files-129312398/files/file_fd84166d2046cf3a.exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

862

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN

Malware family:

n/a

ID:

1

File name:

_4503fe5a9a97249fb92441419b29b21eb52f737b42cfb37cffa5bb8bd55cc356

Verdict:

No threats detected

Analysis date:

2026-05-24 00:51:50 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/1f87f650-77e3-445a-977d-ece104854470

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a124a7098070a72bb9d6bf1

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Restart of the analyzed sample

Creating a process with a hidden window

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Connection attempt to an infection source

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Sending a custom TCP request

Moving a recently created file

Searching for analyzing tools

Searching for the window

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Creating a window

Running batch commands

Creating a service

Launching a service

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a recently created process

Setting a single autorun event

Enabling autorun for a service

Adding an exclusion to Microsoft Defender

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug crypto fingerprint microsoft_visual_cc packed reconnaissance

Link:

https://www.filescan.io/uploads/6a124a48875badc3b3938542/reports/35d97d2c-bc69-407b-a023-ea99f8433d4f/overview

Hybrid Analysis Trojan.Win64.Downloader.oa

Verdict:

Malicious

Labled as:

Trojan.Win64.Downloader.oa

Link:

https://www.hybrid-analysis.com/sample/4503fe5a9a97249fb92441419b29b21eb52f737b42cfb37cffa5bb8bd55cc356

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-05-23T22:06:00Z UTC

Last seen:

2026-05-24T00:21:00Z UTC

Hits:

~1000

Detections:

Trojan-Downloader.Win32.Paph.pva PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/4503fe5a9a97249fb92441419b29b21eb52f737b42cfb37cffa5bb8bd55cc356/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/4503fe5a9a97249fb92441419b29b21eb52f737b42cfb37cffa5bb8bd55cc356

CERT.PL MWDB

Gathering data

Neiki Family.SCARFACESTEALER

Verdict:

Malicious

Threat:

Family.SCARFACESTEALER

Link:

https://tip.neiki.dev/file/4503fe5a9a97249fb92441419b29b21eb52f737b42cfb37cffa5bb8bd55cc356

ReversingLabs TitaniumCloud Win64.Trojan.Qwexlafiba

Threat name:

Win64.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-24 00:47:40 UTC

File Type:

PE+ (Exe)

Extracted files:

11

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iub74wu2s4sj7ojeifazwknsd22s6433ilh3g7h7uw5yxvk4ynla._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260524-a4lv6scx2r/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Checks computer location settings

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.