MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 695585351ff095b744dd04f3fbbbbdbfb40e381730faa2751a8fbc15da26a299. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	695585351ff095b744dd04f3fbbbbdbfb40e381730faa2751a8fbc15da26a299
SHA3-384 hash:	c3ffb252999b5d5c00463a48309f4c0b25cbc4ddc98cd33876b08ebf63b73b5652fe18a7d851eb08432434ecb3f265ba
SHA1 hash:	1ae5d832d087375dca944865c602924c25a3fa12
MD5 hash:	c8881b359613b38e8f99cb389b05360b
humanhash:	failed-connecticut-mexico-xray
File name:	file
Download:	download sample
Signature	ScarfaceStealer Alert Create hunting rule
File size:	90'285'056 bytes
First seen:	2026-07-22 12:22:59 UTC
Last seen:	2026-07-23 17:12:02 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9bf3f5698d1c8e5d8bbe8d194ac5d544 (51 x ScarfaceStealer)
ssdeep	786432:rAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:rAZui3zQz2jOZKft
TLSH	T116187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	fdfc7c7c6466d3c3 (1 x ScarfaceStealer)
Reporter	Bitsight
Tags:	c dropped-by-gcleaner exe MIX6.file ScarfaceStealer

Bitsight

url: http://158.94.209.95/service

Intelligence

---

File Origin

# of uploads :

17

# of downloads :

311

Origin country :

US

Vendor Threat Intelligence

ACCE MurmurHash3_128x64

Details

Link:

https://research.acce.ciphertechsolutions.com/results/2b9a661a-99fb-4ca8-90e0-b614a91bc95b/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Restart of the analyzed sample

Creating a process with a hidden window

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Connection attempt to an infection source

Creating a file in the %temp% subdirectories

Deleting a recently created file

Query of malicious DNS domain

Sending a TCP request to an infection source

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug crypto fingerprint microsoft_visual_cc packed reconnaissance

Link:

https://www.filescan.io/uploads/6a60b64bdbe11f7f434a4969/reports/2ed91dc4-9cb3-48f4-8830-502b9b8e3eb6/overview

Hybrid Analysis Trojan.Win64.Downloader.oa

Verdict:

Malicious

Labled as:

Trojan.Win64.Downloader.oa

Link:

https://www.hybrid-analysis.com/sample/695585351ff095b744dd04f3fbbbbdbfb40e381730faa2751a8fbc15da26a299

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-22T10:59:00Z UTC

Last seen:

2026-07-23T08:42:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/695585351ff095b744dd04f3fbbbbdbfb40e381730faa2751a8fbc15da26a299/results?tab=lookup

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/695585351ff095b744dd04f3fbbbbdbfb40e381730faa2751a8fbc15da26a299

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nfkykni76ck3org5atz7xo55x62a4oaxgd5ke5i2r66blwrgukmq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260722-pktt1avcle/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Checks computer location settings

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.