MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd7c705a7f08452bf01851c2fc958d9ea98f54dbe1db2dba5aa1886c90533f05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cd7c705a7f08452bf01851c2fc958d9ea98f54dbe1db2dba5aa1886c90533f05
SHA3-384 hash:	6e7bf6019d92fc920db82a69b80826c46a9239e8ac3db703d8295ae4dc12db17f8913c20b12ff4f9184c1ad536a2199d
SHA1 hash:	6764b54c3a1f72a60adb06a784939b001bad21b5
MD5 hash:	eaa08142d7ca5beb7ee8a170b86b0a3f
humanhash:	mango-alabama-alpha-undress
File name:	ReleaseInstaller.exe
Download:	download sample
File size:	88'992'224 bytes
First seen:	2026-09-24 17:49:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (593 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	1572864:ILdki/4/QRTPhvWHyFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB71y:I2V/QRZxaABZVPArg/bXeB71y
TLSH	T136183344076A4104C28F4FF9517B1BFAAF670DE0B266B49B629640B2F9BB4B3C95C14F
TrID	27.0% (.EXE) Win64 Executable (generic) (6522/11/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	0028645468300000
Reporter	Alex_sev
Tags:	electron exe infostealer signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

164

Origin country :

NL

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b36d76ba-435b-416b-a4e4-d4fd3f22b34d/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-24 19:20:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/765f677c-d6bf-48cc-b9a8-3ec10897051c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Running batch commands

Creating a process with a hidden window

Creating a file

Searching for synchronization primitives

Launching the process to interact with network services

Forced system process termination

Launching a process

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Deleting a recently created file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm base64 crypto crypto expand expired-cert fingerprint hacktool installer installer lolbin microsoft_visual_cc nsis reconnaissance signed

Link:

https://www.filescan.io/uploads/6ab562e95d75c8365a9691f8/reports/0e53a86b-3c06-43e2-b56d-70669534a7cc/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/cd7c705a7f08452bf01851c2fc958d9ea98f54dbe1db2dba5aa1886c90533f05

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

exe x32

First seen:

2026-09-19T20:21:00Z UTC

Last seen:

2026-09-19T20:29:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/cd7c705a7f08452bf01851c2fc958d9ea98f54dbe1db2dba5aa1886c90533f05/results?tab=lookup

Nucleon Malprob Susipicious

Score:

44%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/cd7c705a7f08452bf01851c2fc958d9ea98f54dbe1db2dba5aa1886c90533f05

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zv6hawt7bbcsx4aykhbpzfmnt2uy6vg34hns3os2ugegzecth4cq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution

Link:

https://tria.ge/reports/260924-wexf9sssa1/

Behaviour

Checks processor information in registry

Kills process with taskkill

Runs net.exe

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.