MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemoteX

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6
SHA3-384 hash:	7d7a8fda27af380ff288db5e848dc816a2fb6db9dc9e9b55eb93ec0abc29a6a118e11d1d7ecbb9cbb9c202a6edaa4b35
SHA1 hash:	dc223e5e27e3bcc1cc636aa2b9567540868cc6ef
MD5 hash:	658cb87887c1aa843e39aea3aab26073
humanhash:	paris-mango-xray-india
File name:	file
Download:	download sample
Signature	RemoteX Create hunting rule
File size:	17'833'552 bytes
First seen:	2026-08-01 04:43:54 UTC
Last seen:	2026-08-06 03:21:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	88016fcdef7f227c62171d0afad9aae4 (29 x ValleyRAT, 21 x OffLoader, 18 x Tofsee)
ssdeep	393216:YJSSRC8g954fV7n/YQ/toBGBUokPNXVu/QhDbzFbSx3TKBHfGM2a8Z:USSRtgHQFOBGBUxPDMQ5FbSCfGPdZ
TLSH	T1D1073333B389683EE07E1A395977A114583B7B516C178D0A96F4086CCF2A1B17E3B74B
TrID	63.8% (.EXE) Inno Setup installer (107240/4/30) 24.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 3.8% (.EXE) Win64 Executable (generic) (6522/11/2) 2.6% (.EXE) Win32 Executable (generic) (4504/4/1) 1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
dhash icon	94b4b5e4d060e4d8 (1 x RemoteX)
Reporter	Bitsight
Tags:	54e64e dropped-by-amadey exe RemoteX

Bitsight

url: http://91.92.242.236/files-129312398/files/file_fbb6760870c8b3a9.exe

Intelligence

File Origin

# of uploads :

# of downloads :

222

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/6395e986-baa3-43cf-8fdf-43a2b5691572/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/77102/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

Using the Windows Management Instrumentation requests

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug crypto embarcadero_delphi evasive fingerprint inno installer installer installer-heuristic packed reconnaissance

Link:

https://www.filescan.io/uploads/6a6d79ac6fa4c2de959bf1fe/reports/37f7f167-5bdc-4a29-9aaf-243fc31d968e/overview

Verdict:

Malicious

Labled as:

Suspicious:TrojanSpy.Banker.YIR.kkwi.dll

Link:

https://www.hybrid-analysis.com/sample/5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6

Verdict:

Unknown

File Type:

exe x32

First seen:

2026-08-01T16:13:00Z UTC

Last seen:

2026-08-01T23:20:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6/results?tab=lookup

Score:

74%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/658cb87887c1aa843e39aea3aab26073

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l53pynu7h52zuzh6a5ycssrqhsiyyhokllycdou6uc54pkzflh3a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery installer

Link:

https://tria.ge/reports/260801-fc2p7sdh38/

Behaviour

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

System Location Discovery: System Language Discovery

Executes dropped EXE

Loads dropped DLL

Unpacked files

SH256 hash:

5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6

MD5 hash:

658cb87887c1aa843e39aea3aab26073

SHA1 hash:

dc223e5e27e3bcc1cc636aa2b9567540868cc6ef

Link:

https://www.unpac.me/results/0e1c21ae-3f5c-4363-b123-97bbc44a1490/

SH256 hash:

43cb302b5e0d231f19d1b4c9e5877bc4652b60765bbb074abb1021147a1413bb

MD5 hash:

d123ecc8b766b893afadf16766169633

SHA1 hash:

c6b2ee97290bfe46736f5d892625c04e944b3d38

Link:

https://www.unpac.me/results/0e1c21ae-3f5c-4363-b123-97bbc44a1490/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/