MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60c20f43308bcba1e5db4bc9b794ac5e6203747d6209142abcbc896f552b9709. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	60c20f43308bcba1e5db4bc9b794ac5e6203747d6209142abcbc896f552b9709
SHA3-384 hash:	844bb5008c2b7dbb5c39a207c47e3da5649bca05ee6f56c38b788f61f7c8cab5df262751f6fe064265364b6f895e67e7
SHA1 hash:	68d182f8d208be3eac5aa54d03dc09e720f8307e
MD5 hash:	7b5d2ad602a88d8c138b55c56b6aa411
humanhash:	enemy-july-eleven-apart
File name:	UNO-Setup-1.0.0.exe
Download:	download sample
File size:	155'460'546 bytes
First seen:	2026-09-15 21:38:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (593 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	3145728:ZRPl/7Q4ssGEKvPdSeQAtP3lIRAQE/LuT7ehjUrH05D7s1dpnXX:ZPGNJjP3lIaB6T7eH5WpnXX
TLSH	T1237833619780CEBDD733B8B29363AF61DD796A534F0C03CBAB822470B7613E75828565
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	913e3f4953371b86
Reporter	NekoPunchii
Tags:	electron exe stealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

516

Origin country :

US

Vendor Threat Intelligence

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/60c20f43308bcba1e5db4bc9b794ac5e6203747d6209142abcbc896f552b9709

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x32

First seen:

2026-09-15T18:19:00Z UTC

Last seen:

2026-09-15T18:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/60c20f43308bcba1e5db4bc9b794ac5e6203747d6209142abcbc896f552b9709/results?tab=lookup

Nucleon Malprob Benign

Score:

11%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/60c20f43308bcba1e5db4bc9b794ac5e6203747d6209142abcbc896f552b9709

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mdba6qzqrpf2dzo3jpe3pffmlzrag5d5mierikv4xsew6vjls4eq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/260915-1hqv4s1tds/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Adds Run key to start application

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads ssh keys stored on the system

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Looks for VMWare Tools registry key

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/60c20f43308b/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.