MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 683a049283aa3d9d5b3a91c221a930edebd9c64eb712834af47c714c1cd5ba3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	683a049283aa3d9d5b3a91c221a930edebd9c64eb712834af47c714c1cd5ba3e
SHA3-384 hash:	7486d8a12c265e351fb9d8156443da94f1ea17c92e34fbbfee9153abe320d88c2c733d195c65ed500b3008e92b6eaba8
SHA1 hash:	61569a173fcdb8e93ac501d0630ebbcfb41a6111
MD5 hash:	1fd8d83784da63bad0236b67defba99c
humanhash:	fourteen-island-summer-wisconsin
File name:	ToDesk_x64_3.exe
Download:	download sample
Signature	SliverFox Alert Create hunting rule
File size:	131'819'104 bytes
First seen:	2026-11-10 17:52:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	48aa5c8931746a9655524f67b25a47ef (4 x SparkRAT, 4 x Adware.Generic, 3 x Vidar)
ssdeep	3145728:nQUODKXpWPHhXAcQHuETYyV22UuRQBWz30hHn:QUMKXpWPhwcQHuETJA2UuRQM0hH
TLSH	T11E583313F9A584E1C1AE9131C5B652B76B35BC484B2523D71BA0BB387F367C0AE79B04
TrID	72.8% (.EXE) Inno Setup installer (107240/4/30) 9.6% (.EXE) Win32 Executable Delphi generic (14182/79/4) 4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win64 Executable (generic) (6522/11/2) 3.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	b298acbab2ca7a72 (2'335 x GCleaner, 1'831 x Socks5Systemz, 67 x RedLineStealer)
Reporter	Alex_sev
Tags:	dllHijack exe SilverFox SliverFox

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

184

Origin country :

CH

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af35a7ebeffd05f052acc20

Tags:

phishing lien

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/683a049283aa3d9d5b3a91c221a930edebd9c64eb712834af47c714c1cd5ba3e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

PE

First seen:

2026-10-28T22:34:00Z UTC

Last seen:

2026-10-29T00:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/683a049283aa3d9d5b3a91c221a930edebd9c64eb712834af47c714c1cd5ba3e/results?tab=lookup

Nucleon Malprob Benign

Score:

26%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/683a049283aa3d9d5b3a91c221a930edebd9c64eb712834af47c714c1cd5ba3e

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Packed.Generic

Threat name:

Win32.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-29 09:54:17 UTC

File Type:

PE (Exe)

Extracted files:

92

AV detection:

14 of 36 (38.89%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=na5ajeudvi6z2wz2shbcdkjq5xv5trsow4jigsxupryuyhgvxi7a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/261110-wfzysahe55/

Behaviour

GoLang User-Agent

Kills process with taskkill

Modifies data under HKEY_USERS

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

Views/modifies file attributes

Inno Setup is an open-source installation builder for Windows applications.

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

System Owner/User Discovery

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Sets file to hidden

Suspicious use of NtCreateUserProcessOtherParentProcess

VirusSign dllhijack

Malware Family:

dllhijack

Alert

Create hunting rule

Malicious:

True

Tags:

file-overlay exe

Link:

https://intel.virussign.com/intelligence/file/683a049283aa3d9d5b3a91c221a930edebd9c64eb712834af47c714c1cd5ba3e

VMRay SparkRAT

Malware family:

SparkRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/683a049283aa/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.