MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6659f6e7120e112b2d1e5bdd469ed4935c5a11144575950c6e14173a49c1bff9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6659f6e7120e112b2d1e5bdd469ed4935c5a11144575950c6e14173a49c1bff9
SHA3-384 hash:	1d0a57114ff501aa8f5a72b88cdb73bf3ad042389cfc2e408c9ac7757d3dda18bfa9ba8524fadb390a73cac9362266ba
SHA1 hash:	4054599a250848dd2c552676dd941d68f61615cb
MD5 hash:	48052dcc14b40564ae5eec10957b1c7e
humanhash:	arizona-colorado-oxygen-network
File name:	CV-1.0.0-setup.exe
Download:	download sample
Signature	SilentStealer Alert Create hunting rule
File size:	92'029'550 bytes
First seen:	2025-12-11 21:42:43 UTC
Last seen:	2025-12-13 13:56:52 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (532 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:yXYqPsDQQcYL8/vLcPQnCJANlf2AkZQbnywaQ3XMdvrb9KV2vBrJAcRxnauZ:yjPsDQBnYPQVNlO3QWwaQHmUV2ZF7HnT
TLSH	T1621833D943E49922D4F6E77B21F9C1EC045C65661DAE65F122EF33022EE1C0F9ADA306
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	burger
Tags:	exe SilentStealer

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

116

Origin country :

NL

Vendor Threat Intelligence

ACCE NSIS_Installer SplitBlock_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a85c220a-3803-4421-997c-753aaba81e67/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

CV-1.0.0-setup.exe

Verdict:

Malicious activity

Analysis date:

2025-12-11 21:42:18 UTC

Tags:

stealer python generic susp-powershell nodejs evasion auto-reg phishing

Link:

https://app.any.run/tasks/7fa41dec-30b0-4e54-ab07-187d172226f4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=693b3abda675b653bd103cb7

Tags:

shell virus sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm blackhole evasive fingerprint installer installer installer-heuristic microsoft_visual_cc nsis overlay packed

Link:

https://www.filescan.io/uploads/693b3afacf690d27f3dd16c5/reports/63baaa73-1f96-48cc-9e66-7ab74a35f2b2/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6659f6e7120e112b2d1e5bdd469ed4935c5a11144575950c6e14173a49c1bff9

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x32

First seen:

2025-12-11T18:40:00Z UTC

Last seen:

2025-12-12T12:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/6659f6e7120e112b2d1e5bdd469ed4935c5a11144575950c6e14173a49c1bff9/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1831258

Signature

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Disables security and backup related services

Disables Windows Defender (via service or powershell)

Drops large PE files

Found pyInstaller with non standard icon

Loading BitLocker PowerShell Module

Modifies Windows Defender protection settings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Windows Service Tampering

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Yara detected Generic Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

87%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/6659f6e7120e112b2d1e5bdd469ed4935c5a11144575950c6e14173a49c1bff9

CERT.PL MWDB

Gathering data

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/6659f6e7120e112b2d1e5bdd469ed4935c5a11144575950c6e14173a49c1bff9

ReversingLabs TitaniumCloud Win32.Infostealer.Generic

Threat name:

Win32.Infostealer.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-12-11 21:42:21 UTC

File Type:

PE (Exe)

Extracted files:

2621

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mzm7nzysbyiswli6lpounhwusnofueiuiv2zkddocqltusobx74q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution persistence spyware stealer trojan

Link:

https://tria.ge/reports/251211-1k3yfsgv2h/

Behaviour

Kills process with taskkill

Runs net.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Launches sc.exe

An obfuscated cmd.exe command-line is typically used to evade detection.

Enumerates processes with tasklist

Adds Run key to start application

Checks installed software on the system

Indicator Removal: Clear Persistence

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Disables one or more Microsoft Defender components

Windows security bypass

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2c45c534-c94a-43b9-a73e-0b258a758a3b

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.