MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5b84d938d4789d759534e2cdec20d6faea226137d630ac08f3741bd4171cc7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5b84d938d4789d759534e2cdec20d6faea226137d630ac08f3741bd4171cc7c
SHA3-384 hash: 092498e5ff790a3aff0048174c3319c0377b6e493e1d478cbde2a9b67a327c6e7df21d2463f60113668328e30d46c210
SHA1 hash: d7880af626acb4a0ac716372e917b9f9e236c72d
MD5 hash: ae8561a52483d54c27dcdc0090df892b
humanhash: coffee-black-victor-shade
File name:Fivem-Portable-2.1.7.exe
Download: download sample
File size:78'994'223 bytes
First seen:2025-10-01 13:30:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b34f154ec913d2d2c435cbd644e91687 (533 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep 1572864:eSnyLU23CiRNNUXlW6/DddyIONcuGkVRcAz2lVdrH93AMs7uteFI55IZl57E7:eeyLUdtLOCvqcbnHUuWI5K/a7
TLSH T123083340F739E4B2C09EAEB95AC121B9434C2BEB5159B9C15AACD0D25E85FB8335C3F4
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter burger
Tags:exe stealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Fivem-Portable-2.1.7.exe
Verdict:
Suspicious activity
Analysis date:
2025-10-01 13:24:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b6d22504-71a0-4ffd-acf8-3178e6a3ac7b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68dd2b8740b7da0b4eb93e3d
Tags:
vmdetect extens shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Searching for the window
Сreating synchronization primitives
Creating a window
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a file
Searching for synchronization primitives
Unauthorized injection to a recently created process
Loading a suspicious library
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Deleting a recently created file
Adding an exclusion to Microsoft Defender
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole crypto installer microsoft_visual_cc nsis overlay
Link:
https://www.filescan.io/uploads/68dd2d2674e5a289899c4ab5/reports/c78ef909-d71d-4bd8-8c58-5cae41a55a4c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d5b84d938d4789d759534e2cdec20d6faea226137d630ac08f3741bd4171cc7c
Verdict:
Clean
File Type:
exe x32
Link:
https://opentip.kaspersky.com/d5b84d938d4789d759534e2cdec20d6faea226137d630ac08f3741bd4171cc7c/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1787339
Signature
Adds a directory exclusion to Windows Defender
Attempt to bypass Chrome Application-Bound Encryption
Disables security and backup related services
Disables Windows Defender (via service or powershell)
Drops large PE files
Found pyInstaller with non standard icon
Loading BitLocker PowerShell Module
Modifies Windows Defender protection settings
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Suspicious Windows Service Tampering
Sigma detected: WScript or CScript Dropper
Tries to harvest and steal browser information (history, passwords, etc)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1787339 Sample: Fivem-Portable-2.1.7.exe Startdate: 01/10/2025 Architecture: WINDOWS Score: 100 109 Sigma detected: Powershell Defender Disable Scan Feature 2->109 111 Sigma detected: WScript or CScript Dropper 2->111 113 Sigma detected: Suspicious Windows Service Tampering 2->113 115 4 other signatures 2->115 10 Fivem-Portable-2.1.7.exe 279 2->10         started        14 msedge.exe 2->14         started        process3 dnsIp4 85 C:\Users\user\AppData\Local\...\Fivem.exe, PE32+ 10->85 dropped 87 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 10->87 dropped 89 C:\Users\user\AppData\Local\...\System.dll, PE32 10->89 dropped 93 12 other files (none is malicious) 10->93 dropped 139 Drops large PE files 10->139 17 Fivem.exe 1002 10->17         started        107 239.255.255.250 unknown Reserved 14->107 91 C:\Users\user\AppData\Local\...\Login Data, SQLite 14->91 dropped 22 msedge.exe 14->22         started        24 msedge.exe 14->24         started        file5 signatures6 process7 dnsIp8 95 198.1.195.210 CRONOMAGIC-1CA Canada 17->95 97 162.159.135.232 CLOUDFLARENETUS United States 17->97 103 4 other IPs or domains 17->103 77 C:\Users\user\AppData\...\vcruntime140_1.dll, PE32+ 17->77 dropped 79 C:\Users\user\AppData\...\vcruntime140.dll, PE32+ 17->79 dropped 81 C:\Users\user\AppData\Local\...\pythonw.exe, PE32+ 17->81 dropped 83 824 other files (none is malicious) 17->83 dropped 117 Attempt to bypass Chrome Application-Bound Encryption 17->117 119 Tries to harvest and steal browser information (history, passwords, etc) 17->119 121 Modifies Windows Defender protection settings 17->121 123 4 other signatures 17->123 26 cmd.exe 17->26         started        29 cmd.exe 17->29         started        31 cmd.exe 17->31         started        33 28 other processes 17->33 99 13.107.6.158 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 22->99 101 150.171.22.17 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 22->101 105 2 other IPs or domains 22->105 file9 signatures10 process11 signatures12 131 Modifies Windows Defender protection settings 26->131 133 Adds a directory exclusion to Windows Defender 26->133 135 Disables Windows Defender (via service or powershell) 26->135 50 2 other processes 26->50 35 powershell.exe 29->35         started        38 conhost.exe 29->38         started        40 powershell.exe 31->40         started        42 conhost.exe 31->42         started        137 Windows Scripting host queries suspicious COM object (likely to drop second stage) 33->137 44 cscript.exe 33->44         started        46 cscript.exe 33->46         started        48 reg.exe 33->48         started        52 43 other processes 33->52 process13 signatures14 125 Loading BitLocker PowerShell Module 40->125 54 Conhost.exe 42->54         started        69 2 other processes 42->69 127 Adds a directory exclusion to Windows Defender 44->127 56 powershell.exe 44->56         started        59 powershell.exe 46->59         started        61 Conhost.exe 48->61         started        63 net1.exe 52->63         started        65 Conhost.exe 52->65         started        67 Conhost.exe 52->67         started        71 3 other processes 52->71 process15 signatures16 129 Loading BitLocker PowerShell Module 56->129 73 conhost.exe 56->73         started        75 conhost.exe 59->75         started        process17
Score:
63%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/d5b84d938d4789d759534e2cdec20d6faea226137d630ac08f3741bd4171cc7c
Gathering data
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/d5b84d938d4789d759534e2cdec20d6faea226137d630ac08f3741bd4171cc7c
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2w4e3e4ni6e5owktjywn5qqnn6xkejqtpvrqvqepg5a32qlrzr6a._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
credential_access defense_evasion discovery execution linux spyware stealer trojan
Link:
https://tria.ge/reports/251001-qsa8asvxcz/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Launches sc.exe
An obfuscated cmd.exe command-line is typically used to evade detection.
Enumerates processes with tasklist
Hide Artifacts: Hidden Files and Directories
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Uses browser remote debugging
Windows security bypass
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/87ec76ff-cf6a-4fd2-9880-8274e6413553
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments