MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64a93971587ee0521ecbfd3a3b2c04de75aff5cc1cb70ac104aa3ab7395c66ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	64a93971587ee0521ecbfd3a3b2c04de75aff5cc1cb70ac104aa3ab7395c66ab
SHA3-384 hash:	f99f80d601569b2397db7caf0882fc4a4093ffce6f8b13d1d0babc233d34e8a68abfee24cfa0c2bab2abc7466788a213
SHA1 hash:	ea8b2a706fa1251dd013a0f36c72c180ae512be8
MD5 hash:	2055c8bcf91205b274d4a411d536da2c
humanhash:	bakerloo-three-march-minnesota
File name:	instbeta.exe
Download:	download sample
File size:	99'279'175 bytes
First seen:	2026-05-16 18:14:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	46ce5c12b293febbeb513b196aa7f843 (42 x GuLoader, 21 x RemcosRAT, 10 x AgentTesla)
ssdeep	1572864:3ylRCMKXYwbxCy9htw3FwLlXjsuz2z3N9VNJ4iN4NBiQztJwGw+5bkXcy744Q0Bc:3yVKIiCqh+VwLlXjTz2z3N9F4iGpzI+v
Threatray	13 similar samples on MalwareBazaar
TLSH	T1C928334933BF6833C23E827BFDF568DA25D15EB36C07D01228E4995A19CE5B7E168603
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	71f8cccccc82cccc
Reporter	Ling
Tags:	exe Shellcode ShellCodeRunner

CNGaoLing

ShellcodeRunner

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

118

Origin country :

US

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5a5079eb-5c38-47d5-b4f2-f111b9e576db/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

instbeta.exe

Verdict:

No threats detected

Analysis date:

2026-05-16 17:38:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b1c51c12-6248-402f-a2bb-a9812a4194a9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a08ab5f953bbcef1c90bc6c

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug evasive evasive installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance smb

Link:

https://www.filescan.io/uploads/6a08b45fefbd399b39b32fd9/reports/d4568aa0-2a9a-4d30-bc85-7173efadc9b1/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/64a93971587ee0521ecbfd3a3b2c04de75aff5cc1cb70ac104aa3ab7395c66ab

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-15T23:59:00Z UTC

Last seen:

2026-05-17T18:22:00Z UTC

Hits:

~100

Detections:

Trojan.Win64.Silverfox.sb PDM:Exploit.Win32.Generic Trojan.Win32.Shellcode.poc Trojan-Downloader.Agent.TCP.C&C HEUR:Trojan.Win32.Generic HEUR:Trojan.PowerShell.Starter.gen HackTool.Multi.AmsiETWPatch.sb Trojan.Win32.Shellcode.sb HEUR:Trojan.Win32.ShellEx.gen not-a-virus:AdWare.Win32.Agent.jxja

Link:

https://opentip.kaspersky.com/64a93971587ee0521ecbfd3a3b2c04de75aff5cc1cb70ac104aa3ab7395c66ab/results?tab=lookup

Nucleon Malprob Benign

Score:

13%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/64a93971587ee0521ecbfd3a3b2c04de75aff5cc1cb70ac104aa3ab7395c66ab

CERT.PL MWDB

Gathering data

Neiki Trojan.Win32.Shellcode

Verdict:

Malicious

Threat:

Trojan.Win32.Shellcode

Link:

https://tip.neiki.dev/file/64a93971587ee0521ecbfd3a3b2c04de75aff5cc1cb70ac104aa3ab7395c66ab

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-16 17:37:31 UTC

File Type:

PE (Exe)

Extracted files:

2618

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=msuts4kyp3qfehwl7u5dwlae3z2275omds3qvqievi5look4m2vq._file

Threatray donutloader

Verdict:

malicious

Label(s):

donutloader

Alert

Create hunting rule

Similar samples:

0855861fc39342ca8009838782c39351be5da43e60809aa13322f11cd95d59ad

1080a64f454e01a3e5b59aced1413d72148223604923ad1fc8bd22372b3cc8f9

2dfef0050dac212ceb9e8c91e31a7f6d229b2ccde1cf1d2eabc8d7d11d738324

64a93971587ee0521ecbfd3a3b2c04de75aff5cc1cb70ac104aa3ab7395c66ab

89e382df6016199cbee7bd8732b517b36e2e9b0d3efc54e766d3485b67a46646

b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1

c2253567a3f2d21e6967ccde19dd2dbaede5da54a46eb872c68a732358a81796

cda8b9c1cb730cc256b447fd3cdf6e8c0de981c1dec3e1d1fb372c645c28fb94

error

f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf

+ 3 additional samples on MalwareBazaar

Hatching Triage

Gathering data

VMRay DonutLoader

Malware family:

DonutLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/64a93971587e/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.