MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc7615f394446ebec2ee732636de22153f38756f63277359ca2f78eadb07f42a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bc7615f394446ebec2ee732636de22153f38756f63277359ca2f78eadb07f42a
SHA3-384 hash:	8a97cccd0a8d7776563588c8bd5dcc108cf204ace91acc26306c0afbc9b728d2e2bc84db8b15da5ce13f233a953db5a8
SHA1 hash:	e517d54e082141dc2b9884aa659f2e0f02c201b2
MD5 hash:	33934bba3a04e6dbbf47d63cc598bb4c
humanhash:	connecticut-oranges-kitten-lake
File name:	FACEITInstaller_64.exe
Download:	download sample
File size:	148'063'008 bytes
First seen:	2026-11-01 00:23:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	2057790ae7855765d51bdc4142e62f9c (80 x RemusStealer, 8 x ValleyRAT, 7 x SalatStealer)
ssdeep	3145728:ESabllLMDEPEkjLHs1MR3nBMoPM6CosBbdKXO3LWeEmu2iMnooXQ+:ESQ/0EPE0HsyWoP4osBuSqea23oW
TLSH	T1B3683362B6E7AAACE6056B3ECC8D8119E730F8C50DD18BDFD7114D69BE4998187243C3
TrID	93.7% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 2.3% (.EXE) Win64 Executable (generic) (6522/11/2) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.7% (.EXE) OS/2 Executable (generic) (2029/13) 0.7% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	30a88ea2b6cc6970
Reporter	Parper
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

414

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae686c9b175ade21dced846

Tags:

injection shell virus

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Creating synchronization primitives

Searching for synchronization primitives

Creating a file in the Program Files subdirectories

Creating a process from a recently created file

Launching a process

Creating a process with a hidden window

Sending a custom TCP request

Creating a file

Creating a file in the %temp% subdirectories

Using the Windows Management Instrumentation requests

Running batch commands

Connection attempt

DNS request

Connection attempt to an infection source

Sending an HTTP GET request

Adding a root certificate

Enabling the use of the proxy server

Setting a new proxy server as a default one

Blocking the User Account Control

Blocking the Windows Defender launch

Query of malicious DNS domain

Sending a TCP request to an infection source

Enabling autorun by creating a file

Adding an exclusion to Microsoft Defender

Enabling autorun

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/bc7615f394446ebec2ee732636de22153f38756f63277359ca2f78eadb07f42a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-31T21:38:00Z UTC

Last seen:

2026-11-01T04:12:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.Agent.sb Trojan.PowerShell.DefenderDisabler.sb HEUR:Trojan.Win32.Agent.gen HEUR:Trojan.PowerShell.DefenderDisabler.gen not-a-virus:HEUR:RiskTool.PowerShell.AVDisabler.gen

Link:

https://opentip.kaspersky.com/bc7615f394446ebec2ee732636de22153f38756f63277359ca2f78eadb07f42a/results?tab=lookup

Nucleon Malprob Susipicious

Score:

46%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/bc7615f394446ebec2ee732636de22153f38756f63277359ca2f78eadb07f42a

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Suschil

Threat name:

Win64.Trojan.Suschil

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-01 00:24:47 UTC

File Type:

PE+ (Exe)

Extracted files:

79

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xr3bl44uirxl5qxoomtdnxrccu7tq5lpmmtxgwokf54ovwyh6qva._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution installer

Link:

https://tria.ge/reports/261101-ap8fma1xh1/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Command and Scripting Interpreter: PowerShell

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Executes dropped EXE

Contains code to disable Windows Defender

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.