MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f72fdfd7ce62dd6f11f84c260964cba377736d2e86204f18f2e2ebd78c6fab6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9f72fdfd7ce62dd6f11f84c260964cba377736d2e86204f18f2e2ebd78c6fab6
SHA3-384 hash:	b33bdb8dc755c44875ece2c2b2413116a1f8b99772725edcec1b189f9815a8229df86828e812e5c9aa22c3057e3e94ae
SHA1 hash:	97cc4d1f07f5eb1b7af9c9b51205d4e55db803f0
MD5 hash:	b229ccac7f803b3c75cbd814c2c95806
humanhash:	mirror-oscar-tennessee-saturn
File name:	v3.1.1.exe
Download:	download sample
File size:	91'900'608 bytes
First seen:	2026-08-28 16:41:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (592 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	1572864:wN2um44HiXL4mZLZN2XNAzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXA:wNTm4vXL4mBgJ9NYJo+sUifljLcs22/x
TLSH	T1FE18338A7F22A47FE457E472E0096AE9334AF554D3334B9B112F64DDECF2B109B844A1
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	c4dadadad2f492c2 (148 x GuLoader, 51 x RemcosRAT, 23 x VIPKeylogger)
Reporter	Alex_sev
Tags:	electron exe infostealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

168

Origin country :

RO

Vendor Threat Intelligence

ACCE NSIS_Installer SplitBlock_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e89143f1-abb4-41aa-9a8d-e897b7bbf2a0/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-08-28 16:50:53 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b8cc8005-d904-41ca-aa2f-891765feef81

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Creating a window

Searching for the window

Searching for the Windows task manager window

Creating a file

Creating a process from a recently created file

Searching for synchronization primitives

Deleting a recently created file

Running batch commands

Creating a process with a hidden window

Launching the process to interact with network services

Launching a process

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Forced system process termination

DNS request

Connection attempt

Sending a custom TCP request

Possible injection to a system process

Adding an exclusion to Microsoft Defender

Hybrid Analysis Generik.BPFDKPC trojan

Verdict:

Malicious

Labled as:

Generik.BPFDKPC trojan

Link:

https://www.hybrid-analysis.com/sample/9f72fdfd7ce62dd6f11f84c260964cba377736d2e86204f18f2e2ebd78c6fab6

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-08-28T15:05:00Z UTC

Last seen:

2026-08-28T15:28:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9f72fdfd7ce62dd6f11f84c260964cba377736d2e86204f18f2e2ebd78c6fab6/results?tab=lookup

Nucleon Malprob Malware

Score:

84%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/9f72fdfd7ce62dd6f11f84c260964cba377736d2e86204f18f2e2ebd78c6fab6

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-21 05:49:56 UTC

File Type:

PE (Exe)

Extracted files:

147

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t5zp37l44yw5n4i7qtbgbfsmxi3xonws5braj4mpfyxl26gg7k3a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution trojan

Link:

https://tria.ge/reports/260828-t7wdka1bne/

Behaviour

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Hide Artifacts: Ignore Process Interrupts

Executes a VBScript file via the Windows Script Host.

Checks installed software on the system

Hide Artifacts: Hidden Window

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

System Binary Proxy Execution: Rundll32

Command and Scripting Interpreter: PowerShell

Windows security bypass

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.