MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c89b7710d04becb7c5bfde65497892bb070ef979dd713bb8efe231504c38e2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4c89b7710d04becb7c5bfde65497892bb070ef979dd713bb8efe231504c38e2e
SHA3-384 hash:	773b6b3e5674da11d029142491939d2ec86c3a4f2b171f3cbb9ec1822e07685cbc96cb8a45e2b43a4203859056fd552c
SHA1 hash:	25455645ff33f6206dd391da29bd581a90f57cde
MD5 hash:	a5398e9c406b270dc7e64497bd8304bb
humanhash:	magazine-high-harry-carolina
File name:	FACEITInstaller_64.exe
Download:	download sample
File size:	147'293'922 bytes
First seen:	2026-10-23 11:59:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	2057790ae7855765d51bdc4142e62f9c (80 x RemusStealer, 8 x ValleyRAT, 6 x SalatStealer)
ssdeep	3145728:2bllLMDEPEkjLH251MR3nBMoPM6CosBbdKXO3LWeEmu2iMnooXQ5:8/0EPE0H25yWoP4osBuSqea23ox
TLSH	T1BB683362B6D7AA6CE6056B3D8C8D8119E730FCC90ED18BDFD7104E79AE4A58187253C3
TrID	93.7% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 2.3% (.EXE) Win64 Executable (generic) (6522/11/2) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.7% (.EXE) OS/2 Executable (generic) (2029/13) 0.7% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	30a88ea2b6cc6970
Reporter	Parper
Tags:	exe miner

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

186

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6adb4cb35a22ac805bd9ca01

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Creating synchronization primitives

Searching for synchronization primitives

Creating a file in the Program Files subdirectories

Creating a process from a recently created file

Launching a process

Creating a process with a hidden window

Creating a file

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a file in the %temp% subdirectories

Running batch commands

Connection attempt

DNS request

Connection attempt to an infection source

Sending an HTTP POST request

Adding a root certificate

Enabling the use of the proxy server

Setting a new proxy server as a default one

Blocking the User Account Control

Blocking the Windows Defender launch

Query of malicious DNS domain

Enabling autorun by creating a file

Adding an exclusion to Microsoft Defender

Enabling autorun

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/4c89b7710d04becb7c5bfde65497892bb070ef979dd713bb8efe231504c38e2e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-23T08:48:00Z UTC

Last seen:

2026-10-23T08:55:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Win32.Agent.gen HEUR:Trojan.VBS.Starter.gen HEUR:Trojan.PowerShell.DefenderDisabler.gen Trojan.Win32.Agent.sb Trojan.PowerShell.DefenderDisabler.sb not-a-virus:HEUR:RiskTool.PowerShell.AVDisabler.gen

Link:

https://opentip.kaspersky.com/4c89b7710d04becb7c5bfde65497892bb070ef979dd713bb8efe231504c38e2e/results?tab=lookup

Nucleon Malprob Susipicious

Score:

46%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/4c89b7710d04becb7c5bfde65497892bb070ef979dd713bb8efe231504c38e2e

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Kepavll

Threat name:

Win64.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-23 12:01:29 UTC

File Type:

PE+ (Exe)

Extracted files:

18

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jse3o4inas7mw7c37xtfjf4jfoyhb34xtxlrho4o7yrrkbgdryxa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/261023-n6yjmsdw5k/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Drops file in Program Files directory

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Contains code to disable Windows Defender

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Krev260 commented on 2026-10-23 12:04:10 UTC

https://github.com/ManlyF/FaceitACC/releases/tag/extention

Krev260 commented on 2026-10-23 11:59:38 UTC

src
https://github.com/ManlyF/FaceitACC/releases/download/extention/FACEITInstaller_64.exe
https://www.twitch.tv/faceit_validation/about
https://faceit-anticheat.1verification.com/