MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2f62dca0fbfecf78be84eb792b97b615b35aaeeb063cee3f165dd38bfafacbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b2f62dca0fbfecf78be84eb792b97b615b35aaeeb063cee3f165dd38bfafacbe
SHA3-384 hash:	9585e7706515fae8133b133ce27c13736ad437977b191c07d0effd8fce1bb01064385e2e1bc847ee7d2da92f834d9bec
SHA1 hash:	26ec3f8efe8db7a56460af02b60f6c3438f562c2
MD5 hash:	3506e4b76c80f8391e6a5d61c3bc1c98
humanhash:	arizona-papa-steak-kitten
File name:	OrvexBeta Setup 1.2.1.exe
Download:	download sample
File size:	104'636'056 bytes
First seen:	2026-10-17 13:50:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	b34f154ec913d2d2c435cbd644e91687 (594 x GuLoader, 131 x RemcosRAT, 86 x EpsilonStealer)
ssdeep	3145728:LzLIwYijwWOpyTyoBruFLsJiRG1uOSTcS:zIwVjwPSBruFLsJ9/Sr
TLSH	T1C238332E44CF557EC6232F725361A51081BE6A726766C025EDB73C3D8ABC0E4BE93817
TrID	27.0% (.EXE) Win64 Executable (generic) (6522/11/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	37fe561337e52aa8
Reporter	Alex_sev
Tags:	electron exe infostealer signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

196

Origin country :

NL

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b0a685ff-dc7e-4144-8fec-dcd7e5d122aa/

CyberFortress Clean

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad37d6c6f551121ba16a973

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating synchronization primitives

Creating a window

Searching for the window

Searching for the Windows task manager window

Launching a process

Creating a process with a hidden window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a file

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Deleting a recently created file

Searching for synchronization primitives

Running batch commands

Unauthorized injection to a recently created process

Loading a suspicious library

DNS request

Moving a file to the %AppData% subdirectory

Connection attempt

Moving a file to the %temp% subdirectory

Replacing files

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Launching a tool to kill processes

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

adaptive-context adaptive-context anti-debug anti-vm crypto fingerprint installer installer microsoft_visual_cc nsis packed reconnaissance signed

Link:

https://www.filescan.io/uploads/6ad37d62d1ac717f51eb9985/reports/976ffb50-5d48-4cee-8c8d-871b70e003bf/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b2f62dca0fbfecf78be84eb792b97b615b35aaeeb063cee3f165dd38bfafacbe

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/b2f62dca0fbfecf78be84eb792b97b615b35aaeeb063cee3f165dd38bfafacbe

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wl3c3sqpx7wppc7ij23zfol3mfntlkxowbr45y7rmxotrp5pvs7a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/261017-q534vagx7s/

Behaviour

Checks processor information in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Enumerates physical storage devices

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Hide Artifacts: Ignore Process Interrupts

Discovers running processes

Executes a VBScript file via the Windows Script Host.

Adds Run key to start application

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.