MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d0ddbde8a5d13ccbe2b900c4733cb32554c6f31ca69958998f3908b1e7f36e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6d0ddbde8a5d13ccbe2b900c4733cb32554c6f31ca69958998f3908b1e7f36e1
SHA3-384 hash:	ced61e63573e185a80da74ef0a5c8b5742a79c8e3c082372d257278b67df6a0565a6d92e7ad32136239bcea4557a7d00
SHA1 hash:	f6bc620925783b807f9bdf197e201e5dc2caaf50
MD5 hash:	9e7e474040503dae44295949a3ffcc8a
humanhash:	july-mars-wisconsin-single
File name:	teste.exe
Download:	download sample
File size:	84'939'938 bytes
First seen:	2026-05-19 20:23:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (593 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	1572864:JXY0W18leoHgdg9K05W4NLzKgqGW4qHHH3hrDcOOeysdqTrEIlr7:hYnpS0/05WNgqL4qHn3hr4B+oTrxlr7
TLSH	T17918332431C5AA87D365B6B7A7E164F26C477E08B2D9C1FBD4FCB74D6681A232C04236
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	BlinkzSec

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

RO

Vendor Threat Intelligence

ACCE NSIS_Installer SplitBlock_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/860d7048-4a1a-46ca-899c-cf8c7856ff85/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-05-19 20:28:19 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/62ac16a0-b29f-4cde-888d-b7261b789e39

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0cc7594f2b29ce04017950

Tags:

autorun extens shell sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

Sending a custom TCP request

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Creating a file in the %AppData% subdirectories

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a file

DNS request

Unauthorized injection to a recently created process

Connection attempt

Sending an HTTP GET request

Moving a file to the %AppData% subdirectory

Loading a suspicious library

Launching many processes

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

Hybrid Analysis Trojan/Agent.crxm

Verdict:

Suspicious

Labled as:

Trojan/Agent.crxm

Link:

https://www.hybrid-analysis.com/sample/6d0ddbde8a5d13ccbe2b900c4733cb32554c6f31ca69958998f3908b1e7f36e1

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-19T18:03:00Z UTC

Last seen:

2026-05-20T18:46:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Disco.HTTP.C&C Trojan-Downloader.Win32.Agent.xydsrw Trojan-Downloader.Win32.Agent Trojan-Downloader.Agent.HTTP.C&C Backdoor.Agent.TCP.C&C Backdoor.Agent.HTTP.C&C Trojan-Spy.Stealer.HTTP.C&C Trojan-Spy.Agent.HTTP.C&C

Link:

https://opentip.kaspersky.com/6d0ddbde8a5d13ccbe2b900c4733cb32554c6f31ca69958998f3908b1e7f36e1/results?tab=lookup

Nucleon Malprob Malware

Score:

80%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/6d0ddbde8a5d13ccbe2b900c4733cb32554c6f31ca69958998f3908b1e7f36e1

CERT.PL MWDB

Gathering data

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/6d0ddbde8a5d13ccbe2b900c4733cb32554c6f31ca69958998f3908b1e7f36e1

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-19 20:07:28 UTC

File Type:

PE (Exe)

Extracted files:

3334

AV detection:

8 of 38 (21.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nug5xxukluj4zprlsageom6lgjkuy3zrzjuzlcmy6oiiwht7g3qq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution linux persistence pyinstaller spyware stealer

Link:

https://tria.ge/reports/260519-y6n1baey4r/

Behaviour

Kills process with taskkill

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Detects Pyinstaller

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Enumerates processes with tasklist

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.