MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454
SHA3-384 hash:	3d9e191884c91fe781335aa323fdd7cd7eb0c306ef67a1025a1a094aaad6ee2f0a062efacdccff9c584b90eb59d043bb
SHA1 hash:	99e6b348e8814e8551d7ae5097aed76e6e5f08ef
MD5 hash:	472373ebc24873bd47ff38e5f4a59099
humanhash:	batman-red-island-mike
File name:	file
Download:	download sample
File size:	100'948'756 bytes
First seen:	2026-03-16 15:43:45 UTC
Last seen:	2026-03-16 15:47:45 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (557 x GuLoader, 119 x RemcosRAT, 82 x EpsilonStealer)
ssdeep	1572864:ZYxcfesquEqemJH9GIlFKT4foTuwwwXYPDwmjA8d+5ZW1e/W5JG4km7:6qesA6d3TKkoAPxkIIaJG477
TLSH	T16D2833D61FB0C919C5D6BE331292BCE7223C83437B82846D4AD6325309FCA797F595A2
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543

Bitsight

url: http://74.0.32.149/gate.exe

Intelligence

---

File Origin

# of uploads :

13

# of downloads :

198

Origin country :

US

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/bd195611-ed72-43cf-8da1-e257b089e903/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

_5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454

Verdict:

No threats detected

Analysis date:

2026-03-16 15:48:42 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7dcb7cec-3f97-4402-a866-8b20c79751be

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69b8255b93b644ca466aa39f

Tags:

phishing extens shell sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

DNS request

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Creating a file in the %AppData% subdirectories

Launching a tool to kill processes

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug crypto installer installer installer-heuristic microsoft_visual_cc nsis soft-404

Link:

https://www.filescan.io/uploads/69b8254f677ac46843a5b65a/reports/77557f3d-be8a-409c-a37c-391e6e0a8994/overview

Hybrid Analysis Malware_51.4

Verdict:

Suspicious

Labled as:

Malware_51.4

Link:

https://www.hybrid-analysis.com/sample/5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

Detections:

UDS:DangerousObject.Multi.Generic

Link:

https://opentip.kaspersky.com/5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454/results?tab=lookup

Nucleon Malprob Malware

Score:

84%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454

CERT.PL MWDB

Gathering data

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454

ReversingLabs TitaniumCloud Win32.Trojan.Redirector

Threat name:

Win32.Trojan.Redirector

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-16 15:44:27 UTC

File Type:

PE (Exe)

Extracted files:

2147

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lqryix3jepdtxit7dp6cbemkxhe72qjrzwhbw6ykwxmnmcqbmrka._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery execution linux spyware stealer

Link:

https://tria.ge/reports/260316-s6kd8sby4v/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Reads user/profile data of web browsers

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.