MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4da84da1a94a8d267e11eccbb4e43e20ce41da4714231f90d2d3903e672d69df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4da84da1a94a8d267e11eccbb4e43e20ce41da4714231f90d2d3903e672d69df
SHA3-384 hash:	4cd6a548d768591373e0d8ecf6008cd554b8987e251f5a2381d35c467b0b55dc45acd8c2ecca2c2ddcc52302f7d4cea9
SHA1 hash:	42c66b36dac9e7ff43121b5182fc0e5482eb9fc0
MD5 hash:	d393623a8333186198185004bde43d73
humanhash:	failed-apart-oxygen-georgia
File name:	Spoofer.exe
Download:	download sample
Signature	SilentStealer Alert Create hunting rule
File size:	81'661'816 bytes
First seen:	2025-12-19 13:04:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (584 x GuLoader, 129 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	1572864:UTBAV6xfWKA7OzXY2xXBQvc1CeXQE9Qjwy5/rtfHsh9yopTwmAUw9Vw:UTBAoxfYqzDCc1DAHE4HsHyDVUkw
TLSH	T11508332FC91A95F9D18ED73F868E10F780110513E038BB90AA6947AF927D7039F662D7
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	c4dadadad2f492c2 (138 x GuLoader, 49 x RemcosRAT, 23 x VIPKeylogger)
Reporter	burger
Tags:	exe SilentStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

106

Origin country :

DE

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/8710c885-5a60-48a0-b132-16151abd5f56/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Spoofer.exe

Verdict:

Malicious activity

Analysis date:

2025-12-19 13:03:45 UTC

Tags:

stealer susp-powershell python arch-exec arch-doc evasion auto-reg

Link:

https://app.any.run/tasks/3596e963-9225-44eb-a117-fbc83e90d4c4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69454e3829df60c6e007bcbd

Tags:

xtreme shell sage

FileScan.io

Gathering data

Hybrid Analysis Malware_52.0

Verdict:

Suspicious

Labled as:

Malware_52.0

Link:

https://www.hybrid-analysis.com/sample/4da84da1a94a8d267e11eccbb4e43e20ce41da4714231f90d2d3903e672d69df

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-12-19T10:18:00Z UTC

Last seen:

2025-12-19T14:41:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Script.Agent.gen

Link:

https://opentip.kaspersky.com/4da84da1a94a8d267e11eccbb4e43e20ce41da4714231f90d2d3903e672d69df/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1836267

Signature

Bypasses PowerShell execution policy

Drops large PE files

Found pyInstaller with non standard icon

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Suspicious command line found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Uses cmd line tools excessively to alter registry or file data

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

85%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/4da84da1a94a8d267e11eccbb4e43e20ce41da4714231f90d2d3903e672d69df

CERT.PL MWDB

Gathering data

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/4da84da1a94a8d267e11eccbb4e43e20ce41da4714231f90d2d3903e672d69df

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-12-19 13:03:44 UTC

File Type:

PE (Exe)

Extracted files:

2947

AV detection:

3 of 24 (12.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jwue3injjkgsm7qr5tf3jzb6edhedwshcqrr7egs2oid4zznnhpq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution persistence spyware stealer trojan

Link:

https://tria.ge/reports/251223-p8xksszlfv/

Behaviour

Kills process with taskkill

Runs net.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Launches sc.exe

An obfuscated cmd.exe command-line is typically used to evade detection.

Enumerates processes with tasklist

Adds Run key to start application

Checks installed software on the system

Hide Artifacts: Hidden Window

Indicator Removal: Clear Persistence

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Windows security bypass

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5be9e37a-f406-4c3b-ad5c-b20600aecbe9

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.