MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OffLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c
SHA3-384 hash: 014bca3bb720bb8e5875683a1652572f5cb9d40a026e7f411e2aadb2324e61972989ae51a120792c6afedbb064af1d5e
SHA1 hash: 1d27090ad2cd9702fc723d79e3678253150d5543
MD5 hash: f00058e1c4c67dd47bc962afe4c844a4
humanhash: iowa-ceiling-oscar-minnesota
File name:file
Download: download sample
Signature OffLoader
Create hunting rule
File size:6'394'892 bytes
First seen:2026-03-28 00:54:31 UTC
Last seen:2026-03-28 16:02:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ac4ded70f85ef621e5f8917b250855be (82 x OffLoader, 7 x Gh0stRAT, 6 x Tofsee)
ssdeep 98304:xN66naKaZqA8Mom9dwsKEjQTUfwZ5hDig:FnWENrBUYZ5hig
Threatray 1'036 similar samples on MalwareBazaar
TLSH T12556F127A748A32EE4284977F971E5BC583F666F721E8C05B0E55D4CCB2F4A21D2E243
TrID 63.8% (.EXE) Inno Setup installer (107240/4/30)
24.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.8% (.EXE) Win64 Executable (generic) (6522/11/2)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon 30639985f112d0f1 (2 x OffLoader)
Reporter Bitsight
Tags:b dropped-by-gcleaner exe MIX3.file OffLoader


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
12
# of downloads :
203
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/66d3364f-f657-4740-a3f7-2fcff118a6db/
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2026-03-28 00:57:07 UTC
Tags:
anti-evasion delphi inno installer sainbox rat botnet kamasers udados upx
Link:
https://app.any.run/tasks/4e3c1253-e456-4a9d-bb22-2eca8e9da98d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/59582/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c726fcaacb4c376b14e715
Tags:
injection dropper virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
DNS request
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
embarcadero_delphi expand fingerprint inno installer installer installer-heuristic invalid-signature lolbin packed signed
Link:
https://www.filescan.io/uploads/69c726f82346b9da57ac5706/reports/00df6a68-d0f4-4846-98eb-12b3b9376cea/overview
Verdict:
Malicious
Labled as:
TrojanDldr.OffLoader.gen
Link:
https://www.hybrid-analysis.com/sample/ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-03-27T22:07:00Z UTC
Last seen:
2026-03-28T17:14:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Agent.xcdfpx Trojan.Agent.UDP.ServerRequest
Link:
https://opentip.kaspersky.com/ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e783c4ca-09c6-48e6-b093-a35f1eca08a5
Score:
56%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c/
Verdict:
Malicious
Threat:
Family.UDADOS
Link:
https://tip.neiki.dev/file/ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-03-28 00:55:31 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vyazlzljzelq5vy5gwgkhatuainwdm5ah2stqyrujxbtcowvunga._file
Verdict:
malicious
Label(s):
shellcode_loader_008
Create hunting rule
Similar samples:
0b7a2e642b75da6700daafe701f887522e92a4da4d9c6841bf5cb1c182246512
OffLoader
229aa8d7f88dce937a06c3d10e7ee1a719921c7d56a2d51788bf76520897ae70
OffLoader
2449d6e42c32e2979fd05458312e94a4b1bf3d3b42471576178f3169bb516e37
OffLoader
4dc52e577447f9128cbdb08210420fe8c49844f04cdbcd0f10ac3f55f561637d
OffLoader
8be7f594f8773283f61d37ce24b74985e5569d9c1396c07848e1469a81cd3f5f
OffLoader
8e93e0a19b504ee859dd76d6ff793fe09ffc4075b748c726dc0e3d44f977247c
OffLoader
9667540f87efe7f7e5f7afc233575d0b02a69aa0612d3a0978bb84e376d8b2a4
OffLoader
96d36b91d5dc1a6257bbdad1b2b762e59a88d8d73cbaa317e2568dd7fb153b5f
OffLoader
9fc3f163eefdc65cc1ebb9bc062e32c6a67f30c66cb87a2604e6cca7d0af3a59
OffLoader
db28bd02d536008fc341b13a14b81750332f2b5f98a1093cfbee80ac269ba368
OffLoader
error
OffLoader
+ 1'026 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery installer privilege_escalation upx
Link:
https://tria.ge/reports/260328-a9yf6acs8r/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Access Token Manipulation: Create Process with Token
Enumerates physical storage devices
System Location Discovery: System Language Discovery
UPX packed file
ACProtect 1.3x - 1.4x DLL software
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c
MD5 hash:
f00058e1c4c67dd47bc962afe4c844a4
SHA1 hash:
1d27090ad2cd9702fc723d79e3678253150d5543
Link:
https://www.unpac.me/results/0840050c-37f8-4de2-8064-06283c67ca8e/
SH256 hash:
af72531378ada7a7028458b111bbd24390423e975d3249bf69ac15dc630b8300
MD5 hash:
ecca45d517c00d04e712f69f3ddf29d5
SHA1 hash:
d440e0e960bb14094a9802192708cc99b34c555b
Link:
https://www.unpac.me/results/0840050c-37f8-4de2-8064-06283c67ca8e/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/0840050c-37f8-4de2-8064-06283c67ca8e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OffLoader

Executable exe ae0195e569c9170ed71d358ca38274021b61b3a03ea53862344dc3313ad5a34c

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/59582/

Comments