MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb15e3e58c46d5b4e6fd94e5bb94a6a1100b647ab7a930f1b3434891b6f49b41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb15e3e58c46d5b4e6fd94e5bb94a6a1100b647ab7a930f1b3434891b6f49b41
SHA3-384 hash:	d90bf847733e28fcdca46bf168195cfe5eea46df741b3cac96ce09b4286554608b5acdf9a2c5b6e35ef89f0a6cf6d8a0
SHA1 hash:	14abb1828d279d947b899af70063534a4778354c
MD5 hash:	df85151e01ba5743bea5c937d2695f7b
humanhash:	fifteen-fanta-ten-pluto
File name:	Setup.exe
Download:	download sample
Signature	RemusStealer Alert Create hunting rule
File size:	85'810'036 bytes
First seen:	2026-08-27 17:11:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (592 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	1572864:R882um44Hi8Fk5NIzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXyE:R88Tm4vFNh9NYJo+sUifljLcs22/u
TLSH	T153183346FA21A02FF413C433E15D95FA629BF144D7338BA7123B909EF4A2615AB841F7
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	c4dadadad2f492c2 (148 x GuLoader, 51 x RemcosRAT, 23 x VIPKeylogger)
Reporter	Alex_sev
Tags:	electron exe infostealer RemusStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

224

Origin country :

RO

Vendor Threat Intelligence

ACCE NSIS_Installer SplitBlock_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3f77623d-8849-4733-a4d3-e49a6753bb26/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-08-27 17:16:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/52bbceae-1c36-430e-be33-cf323c0ac9ee

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Creating a window

Searching for the window

Searching for the Windows task manager window

Creating a file

Creating a process from a recently created file

Deleting a recently created file

Running batch commands

Creating a process with a hidden window

Searching for synchronization primitives

Launching the process to interact with network services

Forced system process termination

Launching a process

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context adaptive-context anti-debug crypto installer installer microsoft_visual_cc nsis packed reconnaissance

Link:

https://www.filescan.io/uploads/6a906ff31ebe140a437490b2/reports/e9e85105-1f57-4fa4-a143-36010566ed3e/overview

Hybrid Analysis Generik_NBMNIDX_trojan

Verdict:

Malicious

Labled as:

Generik_NBMNIDX_trojan

Link:

https://www.hybrid-analysis.com/sample/fb15e3e58c46d5b4e6fd94e5bb94a6a1100b647ab7a930f1b3434891b6f49b41

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-08-27T15:57:00Z UTC

Last seen:

2026-08-29T00:43:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fb15e3e58c46d5b4e6fd94e5bb94a6a1100b647ab7a930f1b3434891b6f49b41/results?tab=lookup

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/fb15e3e58c46d5b4e6fd94e5bb94a6a1100b647ab7a930f1b3434891b6f49b41

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-19 04:33:53 UTC

File Type:

PE (Exe)

Extracted files:

147

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7mk6hzmmi3k3jzx5sts3xffgueiawzd2w6utb4ntinejdnxutnaq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery execution spyware stealer trojan

Link:

https://tria.ge/reports/260827-vqz6vsxxgs/

Behaviour

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Hide Artifacts: Ignore Process Interrupts

Executes a VBScript file via the Windows Script Host.

Checks installed software on the system

Hide Artifacts: Hidden Window

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

System Binary Proxy Execution: Rundll32

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Windows security bypass

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fb15e3e58c46d5b4e6fd94e5bb94a6a1100b647ab7a930f1b3434891b6f49b41