MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67ca544f630bc557a367348267e0d47fea783a100bdc49b7ed1f8ea63cd9871c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	67ca544f630bc557a367348267e0d47fea783a100bdc49b7ed1f8ea63cd9871c
SHA3-384 hash:	1066a37b86cb6e366b56fc3127b32e72667976cbaacc03a57ffc34d511f45225ece821cc70deb7de41040c229089bd13
SHA1 hash:	7bcc790d239085d1a2a63ff70e9b7acaaaca9fa6
MD5 hash:	9652c13bb9f8dc080262133df40ac6d9
humanhash:	four-hot-monkey-one
File name:	Faith-1.0.1-setup.exe
Download:	download sample
Signature	SilentStealer Alert Create hunting rule
File size:	90'450'761 bytes
First seen:	2025-12-24 15:34:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (533 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:soYxcnyJVwaweFKT4f9F7I23ru2wcKhVTkqnf1DBKpbd+b3dAGuExCJ+:sbUyJejWKk92VTkQf1D4pWm+6+
TLSH	T15218334702DD5E6FDBEBAA3B45395CBD19358A400BE298F58E976CF217D4E208E0910B
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	burger
Tags:	exe SilentStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

DE

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a06fbf6b-7a72-47a2-af70-b243fb995aa3/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Faith-1.0.1-setup.exe

Verdict:

Malicious activity

Analysis date:

2025-12-24 15:34:39 UTC

Tags:

silentstealer stealer python susp-powershell generic ims-api nodejs evasion discord phishing auto-reg

Link:

https://app.any.run/tasks/22eda6b0-9174-407e-b4a8-a98c1d413bac

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=694c080b01c7b4a8fe5556fd

Tags:

extens shell sage

Hybrid Analysis TR/Malware

Verdict:

Suspicious

Labled as:

TR/Malware

Link:

https://www.hybrid-analysis.com/sample/67ca544f630bc557a367348267e0d47fea783a100bdc49b7ed1f8ea63cd9871c

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

Detections:

HEUR:Trojan-PSW.Win32.Greedy.gen HEUR:Trojan-PSW.Script.Generic HEUR:Trojan-PSW.JS.Greedy.gen HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/67ca544f630bc557a367348267e0d47fea783a100bdc49b7ed1f8ea63cd9871c/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad.troj

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1838910

Signature

Antivirus detection for URL or domain

Disables security and backup related services

Disables Windows Defender (via service or powershell)

Drops large PE files

Found pyInstaller with non standard icon

Loading BitLocker PowerShell Module

Modifies Windows Defender protection settings

Multi AV Scanner detection for submitted file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Suspicious Windows Service Tampering

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Yara detected Generic Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

77%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/67ca544f630bc557a367348267e0d47fea783a100bdc49b7ed1f8ea63cd9871c

CERT.PL MWDB

Gathering data

Neiki Trojan-PSW.Win32.Greedy

Verdict:

Malicious

Threat:

Trojan-PSW.Win32.Greedy

Link:

https://tip.neiki.dev/file/67ca544f630bc557a367348267e0d47fea783a100bdc49b7ed1f8ea63cd9871c

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m7ffit3dbpcvpi3hgsbgpygup7vhqoqqbpoetn7nd6hkmpgzq4oa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution persistence spyware stealer trojan

Link:

https://tria.ge/reports/251224-s1r7wsf13c/

Behaviour

Kills process with taskkill

Runs net.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Launches sc.exe

An obfuscated cmd.exe command-line is typically used to evade detection.

Enumerates processes with tasklist

Adds Run key to start application

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Indicator Removal: Clear Persistence

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Reads user/profile data of web browsers

Disables one or more Microsoft Defender components

Windows security bypass

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/63d2d726-994e-48ac-a524-89d1d3296eea

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.