MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4813dffc1ed2b2a46c8e980a07edc668a3d26ca20d9cc65dc23b9c9dfd3dc2cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4813dffc1ed2b2a46c8e980a07edc668a3d26ca20d9cc65dc23b9c9dfd3dc2cf
SHA3-384 hash:	1fedd9e0f27aa42156a418ab0e62e4d20f869bac2282c7464b6def6b0c8fbdb3953c4aebe9ed462d1bfefeb6026fb6c2
SHA1 hash:	bd7dd24df4843edd3cc6ab943aa1e4ccdaf805b1
MD5 hash:	7a157e80bbe3d2b6bfde402da886cc12
humanhash:	ohio-don-quebec-double
File name:	StreamorApps.exe
Download:	download sample
File size:	104'062'439 bytes
First seen:	2026-09-06 16:53:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (592 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	3145728:iDe4SIG3UlBLbPG2S7f6xI/0A/3/vHLosEtj:N4/GKsj6GcA/3/vWtj
TLSH	T1C6383393FF3A15E8E1D0F73E932E15E50A46F84F990C10A4B3AE21BBBD395855C2191B
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	b064c8cce6f0e434
Reporter	Alex_sev
Tags:	electron exe infostealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

152

Origin country :

RO

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/adbc7c50-8a1e-44cd-aead-8e8db08c97a0/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Searching for the window

Creating a file

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Deleting a recently created file

Unauthorized injection to a recently created process

Searching for synchronization primitives

Loading a suspicious library

Moving a file to the %AppData% subdirectory

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending a custom TCP request

Adding an access-denied ACE

Sending a UDP request

Launching a process

Launching a tool to kill processes

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context adaptive-context anti-debug crypto installer installer microsoft_visual_cc nsis packed reconnaissance

Link:

https://www.filescan.io/uploads/6a9d9ab588658283e9f42a3b/reports/d77463b3-6c2e-419b-b06e-0a1e308ce9dc/overview

Hybrid Analysis Trojan_Script_Multiverze_rfn

Verdict:

Malicious

Labled as:

Trojan_Script_Multiverze_rfn

Link:

https://www.hybrid-analysis.com/sample/4813dffc1ed2b2a46c8e980a07edc668a3d26ca20d9cc65dc23b9c9dfd3dc2cf

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-06T15:02:00Z UTC

Last seen:

2026-09-06T15:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4813dffc1ed2b2a46c8e980a07edc668a3d26ca20d9cc65dc23b9c9dfd3dc2cf/results?tab=lookup

Nucleon Malprob Susipicious

Score:

67%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/4813dffc1ed2b2a46c8e980a07edc668a3d26ca20d9cc65dc23b9c9dfd3dc2cf

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Multiverze

Threat name:

Win32.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-05 02:30:06 UTC

File Type:

PE (Exe)

Extracted files:

7797

AV detection:

14 of 36 (38.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jaj577a62kzki3eotafap3ogncr5e3fcbwommxochooj37j5ylhq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution

Link:

https://tria.ge/reports/260906-vem26awxe1/

Behaviour

Checks processor information in registry

Kills process with taskkill

Modifies registry class

Modifies registry key

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Discovers running processes

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.