MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913
SHA3-384 hash:	01b3bdd862026b6c93b24811ed7c3a0b8533e8cb377a3b5cd02519ce6547c806058a51ab555e917f3eb87b381e90bbf4
SHA1 hash:	7d86cc665d90a040c3c05eec249137146e5c034d
MD5 hash:	9507c69e91b6bfc73ac3442ca44059b6
humanhash:	yellow-arkansas-nineteen-earth
File name:	46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913.exe
Download:	download sample
Signature	NWHStealer Alert Create hunting rule
File size:	97'972'224 bytes
First seen:	2026-10-23 18:39:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	fd6f6d07cc33ee9a2b65bda58a07bb94 (27 x NWHStealer)
ssdeep	1572864:WZa7hmguP2nG0/Vyv7UhgxIabc/97Awb0:WZa7hmguP2nUOTAwb0
TLSH	T118286C43A2E751D8F0BBD17496E65323E933BC490B3469EF12944B312F72AE0A779B11
TrID	55.7% (.WLX) Total Commander Lister extension (plugin) (21500/1/6) 16.9% (.EXE) Win64 Executable (generic) (6522/11/2) 11.6% (.EXE) Win32 Executable (generic) (4504/4/1) 5.2% (.EXE) OS/2 Executable (generic) (2029/13) 5.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	9170cc9296cc7001 (27 x NWHStealer, 1 x XWorm)
Reporter	Kejult
Tags:	bun exe NWH NWHStealer stealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

188

Origin country :

FR

Vendor Threat Intelligence

ACCE MurmurHash3_128x64 MurmurHash3_32

Details

Link:

https://research.acce.ciphertechsolutions.com/results/4b8adce0-8298-4d58-8359-7527fc687bb8/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-23 18:45:19 UTC

Tags:

evasion nwhstealer stealer telegram

Link:

https://app.any.run/tasks/680b1f94-83c1-4569-baa9-ace93f244367

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6adbaa36afb06e650cd8d9ab

Tags:

phishing stealer virus

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Connection attempt to an infection source

Launching a service

Query of malicious DNS domain

Sending a TCP request to an infection source

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug fingerprint obfuscated overlay packed reconnaissance rust

Link:

https://www.filescan.io/uploads/6adbaa2c7bae1b574d38aa4c/reports/06640177-bcd5-43ce-9706-9ae4355f3bca/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-18T03:38:00Z UTC

Last seen:

2026-10-24T11:52:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/46e01d744d46340d827432c1ccdf8a9570786675e9f04cd2110fa72e7d37f913

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-18 09:00:30 UTC

File Type:

PE+ (Exe)

Extracted files:

14

AV detection:

8 of 38 (21.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=i3qb25cniy2a3atugla4zx4ksvyhqztv5hyezuqrb6ts47jx7ejq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/261023-xbqd8atz4k/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Reads the TCP/IP host and domain name from the registry

Maps connected drives based on registry

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.