MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcb381b1d82d602bae96815db9cbf80a6b57b25e22b47a794940803594465aed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dcb381b1d82d602bae96815db9cbf80a6b57b25e22b47a794940803594465aed
SHA3-384 hash:	13374b0532fa7eb15e43d1732fc241ee7be1aaf751145d44ed785a5dec865ef9b621c2d69a034ce49eda095bc8145f62
SHA1 hash:	fbcde536b732c436d3bf26f5772f95d188cbfa80
MD5 hash:	7cb9862b249003018773e8d91e341290
humanhash:	triple-indigo-finch-tango
File name:	Loader.exe
Download:	download sample
Signature	NWHStealer Alert Create hunting rule
File size:	97'861'632 bytes
First seen:	2026-07-26 17:36:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fd6f6d07cc33ee9a2b65bda58a07bb94 (10 x NWHStealer)
ssdeep	1572864:mZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:mZa7hmguP2nUOnAwby
TLSH	T197286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11
TrID	55.7% (.WLX) Total Commander Lister extension (plugin) (21500/1/6) 16.9% (.EXE) Win64 Executable (generic) (6522/11/2) 11.6% (.EXE) Win32 Executable (generic) (4504/4/1) 5.2% (.EXE) OS/2 Executable (generic) (2029/13) 5.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	9170cc9296cc7001 (10 x NWHStealer, 1 x XWorm)
Reporter	aachum
Tags:	cucumber-oslo-cc exe NWHStealer

iamaachum

https://andrewfisher95.github.io/idm-designer-policy-tool-v2026/

NWHStealer C2: cucumber-oslo.cc

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

189

Origin country :

ES

Vendor Threat Intelligence

ACCE MurmurHash3_128x64 MurmurHash3_32

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ae33be7c-84b1-4a41-9712-070a8747be2a/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the Windows subdirectories

DNS request

Connection attempt

Sending a custom TCP request

Launching a service

Query of malicious DNS domain

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug fingerprint obfuscated overlay packed reconnaissance rust

Link:

https://www.filescan.io/uploads/6a6645d8bfcb52e1e0bb957b/reports/0fadabc2-44d3-4f18-bbf3-664738c82bfc/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/dcb381b1d82d602bae96815db9cbf80a6b57b25e22b47a794940803594465aed

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-25T16:22:00Z UTC

Last seen:

2026-07-26T15:49:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/dcb381b1d82d602bae96815db9cbf80a6b57b25e22b47a794940803594465aed/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1948064

Signature

Found direct / indirect Syscall (likely to bypass EDR)

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Unusual module load detection (module proxying)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/dcb381b1d82d602bae96815db9cbf80a6b57b25e22b47a794940803594465aed

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3szydmoyfvqcxluwqfo3ts7ybjvvpms6ek2hu6kjicadlfcgllwq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/260726-v7cf5ayfra/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Looks up external IP address via web service

Maps connected drives based on registry

Checks computer location settings

VMRay XMRig

Malware family:

XMRig

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/dcb381b1d82d/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.