MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6b8e29d928a0ea6f297ab9226025f905d35b436ce480d2bb1de74150e23ea899. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 10
| SHA256 hash: | 6b8e29d928a0ea6f297ab9226025f905d35b436ce480d2bb1de74150e23ea899 |
|---|---|
| SHA3-384 hash: | 179d6be4aadffb66e85e6bb58924e2458c0216da2bf3e9521597c8f147a93097536c12380204154d67f54dba3519fce0 |
| SHA1 hash: | 3cf49518dd5cf3b7894c717038bd0f709d8e1249 |
| MD5 hash: | f9780ff062fc9abbfe8b2c385ed551e9 |
| humanhash: | blue-kilo-oxygen-apart |
| File name: | hrwsInst-V5.6_7.23_xvozm.exe |
| Download: | download sample |
| File size: | 95'374'799 bytes |
| First seen: | 2026-07-27 10:33:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1c8abb0d55065ed8370628959ce78804 (4 x ValleyRAT) |
| ssdeep | 1572864:mXqgR72V+4v+XUV4VG01NmnxCbE3+9R/3m4a4S0UFAZmvS5xa0LRo09peGo52Bs+:3472VFKUV4VGGAb3+Lfq4IFymq5x1e0n |
| TLSH | T10D2833BF2299A11FE32DC13AC2D29F94793770B21B3389E799941269EE075C45E3E710 |
| TrID | 77.3% (.EXE) InstallShield setup (43053/19/16) 11.7% (.EXE) Win64 Executable (generic) (6522/11/2) 3.6% (.EXE) OS/2 Executable (generic) (2029/13) 3.5% (.EXE) Generic Win/DOS Executable (2002/3) 3.5% (.EXE) DOS Executable (generic) (2000/1) |
| Magika | pebin |
| dhash icon | 9c7e4f97b233378f (3 x ValleyRAT, 1 x Metasploit, 1 x AsyncRAT) |
| Reporter |  Ling |
| Tags: | exe SilverFox ValleyRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
265
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-07-27 10:40:36 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Launching a service
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm crypto embarcadero_delphi expired-cert fingerprint inno installer installer installer-heuristic invalid-signature packed reconnaissance signed
Verdict:
Malicious
Labled as:
Trojan.Win64.Generic.oa
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-27T02:28:00Z UTC
Last seen:
2026-07-28T03:34:00Z UTC
Hits:
~100
Detections:
Trojan.Win64.Agent.smgwaq Trojan.Win64.Agent.sb PDM:Trojan.Win32.Generic Trojan.Win32.Autorun.sb Trojan.Win32.Agent.sb Trojan.Multi.Agent.au Trojan.Win32.Injuke.pxmg Trojan.Win32.Shellcode.sb Trojan.Win32.Inject.sb not-a-virus:HEUR:Server-Proxy.Win32.3proxy.gen
Score:
55%
Verdict:
Susipicious
File Type:
PE
Gathering data
Threat name:
Win64.Exploit.DonutMarte
Status:
Malicious
First seen:
2026-07-27 07:11:23 UTC
File Type:
PE+ (Exe)
AV detection:
3 of 36 (8.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
DonutLoader
Similar samples:
Result
Malware family:
n/a
Score:
7/10
Tags:
installer
Behaviour
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Executes dropped EXE
Loads dropped DLL
Malware family:
ValleyRAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 6b8e29d928a0ea6f297ab9226025f905d35b436ce480d2bb1de74150e23ea899
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.