MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efd34ae988e1203ea015b84d2ce234156aa4ac6555cdb90dc9b9ce356208bcf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	efd34ae988e1203ea015b84d2ce234156aa4ac6555cdb90dc9b9ce356208bcf9
SHA3-384 hash:	85ee381cf58cfa527d2114e61ba0ebad6d1883087c7b9376331c67e91fb9d58fdc386863e0c952184b170d1e762187ac
SHA1 hash:	051df94f04b453d8a8c3dd1209a62a42cdf3456b
MD5 hash:	a18cd7ec30217f33ab56412d9a9c1bf0
humanhash:	uranus-pip-comet-one
File name:	KittiesMC Launcher 1.0.0.exe
Download:	download sample
File size:	85'515'382 bytes
First seen:	2026-02-09 21:38:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (566 x GuLoader, 122 x RemcosRAT, 82 x EpsilonStealer)
ssdeep	1572864:AejOYfhsHGleg4ybmMwcjavkIBFfQcTvk0rRYA+m9yZUL8V1UybGoaorPe7:A4JiGlPKNkavkI3jfrR2768VCybG1gm7
TLSH	T15C183344D49CD431F3B1A0BBB22C5D3A649E87C017A75BFD972EE6A87324249EB0C65C
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	a078f0a8b6b6fc0c
Reporter	smica83
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

139

Origin country :

HU

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/4749d41a-8e1c-49fe-8ed3-d728826390ef/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

KittiesMC Launcher 1.0.0.exe

Verdict:

Malicious activity

Analysis date:

2026-02-09 21:41:37 UTC

Tags:

auto-startup stealer github discord arch-doc susp-powershell ims-api generic nodejs

Link:

https://app.any.run/tasks/c6e704f3-8b4f-42f9-af23-3fc5743cba3f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=698a54134c8b031249cdd049

Tags:

autorun xtreme shell sage

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole crypto installer installer installer-heuristic microsoft_visual_cc nsis packed soft-404

Link:

https://www.filescan.io/uploads/698a5409981ff1d38a4ee898/reports/796d0219-5d77-4658-af53-82eea0d2aa4b/overview

Hybrid Analysis Malware_50.2

Verdict:

Suspicious

Labled as:

Malware_50.2

Link:

https://www.hybrid-analysis.com/sample/efd34ae988e1203ea015b84d2ce234156aa4ac6555cdb90dc9b9ce356208bcf9

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-02-09T18:50:00Z UTC

Last seen:

2026-02-11T02:36:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.JS.Hosts.gen HEUR:Trojan-PSW.Win32.Stealer.gen HEUR:Trojan-PSW.JS.Stealer.gen HEUR:Trojan.Win32.Hosts.gen HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/efd34ae988e1203ea015b84d2ce234156aa4ac6555cdb90dc9b9ce356208bcf9/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

adwa.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1866377

Signature

Bypasses PowerShell execution policy

Drops large PE files

Drops VBS files to the startup folder

Encrypted powershell cmdline option found

Loading BitLocker PowerShell Module

Modifies the hosts file

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sigma detected: Capture Wi-Fi password

Sigma detected: Drops script at startup location

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Sigma detected: WScript or CScript Dropper

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal WLAN passwords

Unusual module load detection (module proxying)

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/efd34ae988e1203ea015b84d2ce234156aa4ac6555cdb90dc9b9ce356208bcf9

CERT.PL MWDB

Gathering data

Neiki Trojan-PSW.JS.Stealer

Verdict:

Malicious

Threat:

Trojan-PSW.JS.Stealer

Link:

https://tip.neiki.dev/file/efd34ae988e1203ea015b84d2ce234156aa4ac6555cdb90dc9b9ce356208bcf9

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=57juv2mi4eqd5iavxbgszyrucvvkjldfkxg3sdojxhhdkyqixt4q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery spyware stealer

Link:

https://tria.ge/reports/260209-1hsdyadv2h/

Behaviour

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.