MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fdd6fde6ea2e3d40119544558b89ec7d1f295a2b00e2f1383cb728caae1af74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7fdd6fde6ea2e3d40119544558b89ec7d1f295a2b00e2f1383cb728caae1af74
SHA3-384 hash:	e37b333de178452bcbb08e9faaa0e8ed4b921e7d410c9bb256b42fa7da78ac0f8e8a47004fb6f4756649516c2baa32a3
SHA1 hash:	7459af2d0be84580a0c273f709d0f60f2c2eafa2
MD5 hash:	d84608df8858012a0973ada6fcf8cc84
humanhash:	uranus-pizza-music-chicken
File name:	mpextms.exe
Download:	download sample
Signature	NodeStealer Alert Create hunting rule
File size:	86'065'735 bytes
First seen:	2026-07-17 09:27:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (589 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	1572864:RD+BaWatprfMFHjfem8aI32PYUBFyTAzA83iXNJpX0UN6OC5vk61wPlxyOui/8ai:p+ZCrfMFHC6QyFaAyXNJpEk3MvB1OyOA
TLSH	T1261833A44C25C5A1DB3405729266B463AFB90F018AD71CD2418C3DBA37BCBBC696F5F2
TrID	27.0% (.EXE) Win64 Executable (generic) (6522/11/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	smica83
Tags:	exe NodeStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

185

Origin country :

HU

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/230231cf-33dc-40bc-9287-72a78c99e83e/

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a59f8ad56bd89099b557eed

Tags:

vmdetect autorun

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug anti-vm base64 bash cmd crypto crypto expired-cert fingerprint hacktool installer installer invalid-signature lolbin microsoft_visual_cc nsis reconnaissance signed

Link:

https://www.filescan.io/uploads/6a59f583e42ef721b1726f97/reports/4d2b98b7-60bb-4d60-80d2-58d6672e25cb/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7fdd6fde6ea2e3d40119544558b89ec7d1f295a2b00e2f1383cb728caae1af74

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-07-17T06:57:00Z UTC

Last seen:

2026-07-18T19:10:00Z UTC

Hits:

~10

Detections:

Trojan-PSW.Win32.Alien.th Trojan-Dropper.Win64.Agentb.sb HEUR:Trojan-PSW.Script.Disco.gen

Link:

https://opentip.kaspersky.com/7fdd6fde6ea2e3d40119544558b89ec7d1f295a2b00e2f1383cb728caae1af74/results?tab=lookup

Joe Sandbox Node Stealer

Result

Threat name:

Node Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.adwa.spyw.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1944102

Signature

Drops large PE files

Drops PE files to the startup folder

Sigma detected: PowerShell Get-Process LSASS

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Yara detected Node Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

40%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/7fdd6fde6ea2e3d40119544558b89ec7d1f295a2b00e2f1383cb728caae1af74

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p7ow7xtoulr5iaizkrcvroe6y7i7ffncwahc6e4dznzizkxbv52a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution spyware stealer

Link:

https://tria.ge/reports/260717-le15cabz3t/

Behaviour

Checks processor information in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Enumerates processes with tasklist

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.