MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d994a393c6ccbd7650ea9d6f08a22000350a2de18d418be5a2cb6a62e5e23699. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d994a393c6ccbd7650ea9d6f08a22000350a2de18d418be5a2cb6a62e5e23699
SHA3-384 hash:	5badd8c764ed54189b90514a5f2223cbfa49fb706bec3aa1d7ac0251832a07f7415baf20f7461cd3116d5dfb17cc0bcd
SHA1 hash:	377a695c4f121879b69a737f30756f5a19fc3625
MD5 hash:	b5c7418f409f51bb43f1d81da5bcbd5a
humanhash:	romeo-seven-fruit-sixteen
File name:	FeridoGame.exe
Download:	download sample
Signature	RapidStealer Alert Create hunting rule
File size:	100'943'712 bytes
First seen:	2026-06-21 17:15:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (589 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	1572864:OXY0cVtCqwohNRUSSfwsYvJ3lolczO8NMczQMFIge8cAY89Tsgt+9+flyZOXN:oYnVt8olUSWfSzDNv7e2YEp+9uyZGN
TLSH	T1D92833AC976DB058D30B7B7ED1F2B5F4BA29770063F4849AD43477E89B40D98FA08219
TrID	27.0% (.EXE) Win64 Executable (generic) (6522/11/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	28969696969696e8 (18 x GenesisStealer, 3 x VexxStealer, 2 x CoinMiner)
Reporter	burger
Tags:	exe RapidStealer signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

166

Origin country :

DE

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ea1c761a-7c43-4bf3-ac92-a50a5cae10b6/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

FeridoGame.exe

Verdict:

Malicious activity

Analysis date:

2026-06-21 17:14:11 UTC

Tags:

arch-doc

Link:

https://app.any.run/tasks/9b283816-a94f-4db2-99b0-4b16a6496187

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a381bb21548daf709f8773c

Tags:

n/a

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

Сreating synchronization primitives

Creating a window

Creating a process from a recently created file

Creating a process with a hidden window

Creating a file

Deleting a recently created file

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm base64 crypto evasive expired-cert fingerprint hacktool installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance signed

Link:

https://www.filescan.io/uploads/6a381c4e62d0679105faa28b/reports/6940ad0c-76e8-4da6-812f-589f28518da7/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d994a393c6ccbd7650ea9d6f08a22000350a2de18d418be5a2cb6a62e5e23699

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x32

Link:

https://opentip.kaspersky.com/d994a393c6ccbd7650ea9d6f08a22000350a2de18d418be5a2cb6a62e5e23699/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1931515

Signature

AI detected suspicious PE digital signature

Drops large PE files

Tries to steal communication platform credentials (via file / registry access)

Unusual module load detection (module proxying)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

31%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/d994a393c6ccbd7650ea9d6f08a22000350a2de18d418be5a2cb6a62e5e23699

CERT.PL MWDB

Gathering data

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/d994a393c6ccbd7650ea9d6f08a22000350a2de18d418be5a2cb6a62e5e23699

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3gkkhe6gzs6xmuhktvxqriraaa2qulpbrvayxzncznvgfzpcg2mq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

adware defense_evasion discovery execution linux persistence ransomware spyware stealer trojan

Link:

https://tria.ge/reports/260621-vs3d1ae17z/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.