MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb958f3f129b88fffc6c5fa8eccbf9bf25dd05685041c0bd1dbc8a1dd73992a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb958f3f129b88fffc6c5fa8eccbf9bf25dd05685041c0bd1dbc8a1dd73992a3
SHA3-384 hash:	2d0a7f21784320a6c7d92c8fb45a3475759b9ec3b4460fe98bfec5efc1d3bf72febd201e20899dedd8bcc6a6e78cc129
SHA1 hash:	395112a75a8049d8a8d8126cd2575c626ef9c4dd
MD5 hash:	d7837a7227b7b6e218a124477aea92d8
humanhash:	cardinal-apart-wolfram-utah
File name:	3.6.0_TotlSecuity_4.8.5158.exe
Download:	download sample
File size:	97'962'903 bytes
First seen:	2026-07-27 10:17:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1c8abb0d55065ed8370628959ce78804 (4 x ValleyRAT)
ssdeep	1572864:vXqgR72V+466f70gQ7fG0Hwzhg81A/pQu4oMgcnKTEc+waU5c4I2oUgtgBsDQ4Z1:C472VX70gQ7fdw1g8OBwQaU5Q2ggBsJn
TLSH	T1BF2833BB6264D52BD72DC13BC4A29EA0653B71B20372C5DBD99101A6EF0B6C19E7F310
TrID	51.8% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.8% (.EXE) DOS Executable (generic) (2000/1) 0.2% (.VXD) VXD Driver (29/21)
Magika	pebin
dhash icon	71f8cccccc82cccc
Reporter	Ling
Tags:	exe SilverFox ValleyRAT

CNGaoLing

SilverFox / XAgent
IOC (IP 148.66.11.18:5178)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

142

Origin country :

US

Vendor Threat Intelligence

ACCE

Gathering data

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-07-27 10:32:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/8e416acb-46ee-4cfa-9f48-1309a9b9c3fc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm crypto embarcadero_delphi expired-cert fingerprint inno installer installer installer-heuristic invalid-signature packed reconnaissance signed

Link:

https://www.filescan.io/uploads/6a6730b61baa46a4c3e18a6f/reports/c06a591f-3109-42e6-94c6-70d8b712fff1/overview

Hybrid Analysis Trojan.Win64.Generic.oa

Verdict:

Malicious

Labled as:

Trojan.Win64.Generic.oa

Link:

https://www.hybrid-analysis.com/sample/fb958f3f129b88fffc6c5fa8eccbf9bf25dd05685041c0bd1dbc8a1dd73992a3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-27T02:18:00Z UTC

Last seen:

2026-07-27T06:23:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.AutoRun.sb Trojan.Win32.Shellcode.sb Trojan.Win32.Agent.sb Trojan.Win32.Agent.xcexzw UDS:DangerousObject.Multi.Generic BSS:Trojan.Win32.Generic Trojan.Win32.Inject.sb Trojan.Multi.Agent.au

Link:

https://opentip.kaspersky.com/fb958f3f129b88fffc6c5fa8eccbf9bf25dd05685041c0bd1dbc8a1dd73992a3/results?tab=lookup

Nucleon Malprob Benign

Score:

23%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/fb958f3f129b88fffc6c5fa8eccbf9bf25dd05685041c0bd1dbc8a1dd73992a3

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Exploit.DonutMarte

Threat name:

Win64.Exploit.DonutMarte

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-27 07:21:54 UTC

File Type:

PE+ (Exe)

AV detection:

4 of 36 (11.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7oky6pystoep77dml6uozs7zx4s52blikba4bpi5xsfb3vzzskrq._file

Threatray DonutLoader

Verdict:

malicious

Label(s):

DonutLoader

Alert

Create hunting rule

Link:

https://reports.threatray.com/79e8802c-fb18-4b94-a6bb-35487c092a58

Similar samples:

0d00dcc777435cb0f17207ab832acdb1079998715bdda4df70233d4e8c98fb7f

6b8e29d928a0ea6f297ab9226025f905d35b436ce480d2bb1de74150e23ea899

7ba07adbdb86eafd252678c037fd1a59c15400ca5c38426cb5dce4030f1c7b7d

7d9eecfd59ed832823168e26b60dab4c96974afb57711b4762ddf662454ed963

d6a84954e038ddf4a0026705e0942fc003cfdc04e58f658a6bd9e89c37c57d18

dfbbc455accdfce3fbbd3261a556876adcbff056ceddf48a231c59e0ef920827

fb958f3f129b88fffc6c5fa8eccbf9bf25dd05685041c0bd1dbc8a1dd73992a3

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

installer

Link:

https://tria.ge/reports/260727-mcmplsz1cv/

Behaviour

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

Executes dropped EXE

Loads dropped DLL

VMRay DonutLoader

Malware family:

DonutLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fb958f3f129b/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.