MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fabdfd25643f7d3253415e73b55445071ffa40241d6e65ef492e2d92bce22cab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fabdfd25643f7d3253415e73b55445071ffa40241d6e65ef492e2d92bce22cab
SHA3-384 hash:	935153157d5302f370611727ce2b3729675ce85ff080fe198116d119ad1ea3a58e2d52cb22f055acbc85ff9361aca354
SHA1 hash:	a847482dad4a4c7c05d9834caee6c1b9ab653310
MD5 hash:	b7d4ed04137a715dd6173b76a126de3b
humanhash:	minnesota-nineteen-leopard-alabama
File name:	HearoMovie.exe
Download:	download sample
File size:	119'975'747 bytes
First seen:	2026-11-04 11:28:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	b34f154ec913d2d2c435cbd644e91687 (597 x GuLoader, 131 x RemcosRAT, 86 x EpsilonStealer)
ssdeep	3145728:hPTm4P2kFux0VcVKRbTJRtegoYukCH1yVN6D/NYvelQSntcYI5g:pC4P2kMi9RrKVy36lYvelQwtcdg
TLSH	T1EE4833B4D53478A2CA90943A2C64D5BF06BC8E52C643F62897F83F7B75B3AB504E504B
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	3000b0b2b2a00030
Reporter	Anonymous
Tags:	exe

Anonymous

Infostealing, compromising discord account, google account, corrupting browser extension, disabling task manager etc (i'm a victim, i immediately shut down my pc after figuring out something lurking behind)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

398

Origin country :

ID

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aeb178d3970fcef1e4b07d1

Tags:

autorun adapter virus sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating synchronization primitives

Creating a window

Searching for the window

Searching for the Windows task manager window

Sending a custom TCP request

Creating a file

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Deleting a recently created file

Searching for synchronization primitives

Unauthorized injection to a recently created process

Loading a suspicious library

Creating a process with a hidden window

Moving a file to the %AppData% subdirectory

Launching a process

Using the Windows Management Instrumentation requests

Running batch commands

DNS request

Changing a file

Forced shutdown of a system process

Launching a tool to kill processes

Enabling autorun by creating a file

Forced shutdown of a browser

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fabdfd25643f7d3253415e73b55445071ffa40241d6e65ef492e2d92bce22cab

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x32

Link:

https://opentip.kaspersky.com/fabdfd25643f7d3253415e73b55445071ffa40241d6e65ef492e2d92bce22cab/results?tab=lookup

Nucleon Malprob Benign

Score:

5%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/fabdfd25643f7d3253415e73b55445071ffa40241d6e65ef492e2d92bce22cab

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Malicord

Threat name:

Win32.Trojan.Malicord

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-03 05:24:59 UTC

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7k672jleh56teu2blzz3kvcfa4p7uqbedvxgl32jfywzfphcfsvq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/261104-nms5tavz8q/

Behaviour

Checks processor information in registry

Detects videocard installed

Kills process with taskkill

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Enumerates physical storage devices

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Discovers running processes

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Indicator Removal: Clear Persistence

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.