MalwareTipsTools

File scan report

Scan another file

Verdict Safe

Analyzed , 54 minutes ago

Is BET-Setup.exe safe? Yes, no threats found.

BET-Setup.exe is an Inno Setup installer for a Balatro mod toolkit; only one of the 69 antivirus engines that checked it flagged it, while 18 major antivirus engines and the sandbox report clean.

Moderate evidence · No engine flags it, but no publisher signature confirms who made it.

Install it as usual if it came from the official source

Obtain it only from the official project source, keep antivirus enabled, and scan before running. Treat copies from unofficial sites with caution.

Good practice2 tips

We found nothing harmful in this file.

  1. Install it only if it came from the developer's own website or an official app store.

  2. Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Share this file report

BET-Setup.exe: Safe — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Antivirus results

1 of 69 flagged

  • Flagged 1
  • No detection 68
  • No result 6
FileBET-Setup.exe36.1 MBSHA-256 bd571f0e9d46…c35b4a
  • Code signing Unsigned
  • Test run Completed
  • First seen 4d ago
1 detection rule matched this file; the Safe rating weighed it against the other evidence.

Chapter 02

Why we think so

4 points against it and 4 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

The combined sandbox verdict was clean and the observed network traffic is limited to a Balatro mod service. It is unsigned and protected, so basic caution is reasonable.

Full reasoning

One of the 69 antivirus engines that checked it (DeepInstinct, a machine-learning engine) flagged the file, while all 18 major antivirus engines reported clean. The sandbox combined verdict was clean across three runs, and the process activity matches an Inno Setup installer placing a program under Program Files. The only sample contacts were API devices for a Balatro mod service, and none of the five contacted hosts has a bad reputation. The code is protected with .NET Reactor and unsigned, which our behaviour rule matched as a dropper-like profile, but no dropped or injected malicious component was observed.

Detailed assessment

What We Detected

One of the 69 antivirus engines that checked it flagged the file with a generic machine-learning label; 18 major antivirus engines were clean and no malware family was named.

Threat Behavior

The sandbox saw an Inno Setup installer writing a toolkit under Program Files and its user data folder, then contacting mod-listing devices. Dropped files have no saved verdicts, which is neutral.

What To Do Now

Download it only from the project's official site, keep your security software enabled and scan it before running.

Where this verdict could be wrong3 caveats
  • The file is unsigned and protected with .NET Reactor, which hides its contents; malware often uses the same protector.
  • One engine (DeepInstinct) flagged it, and our behaviour rule for unsigned packed installers with network activity matched.
  • No one inspected the file's contents, and it was first seen on Nov 6, 2026.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour
  • All 18 major antivirus engines reported clean.
  • Combined sandbox verdict was clean across three runs.
  • Network contacts limited to a Balatro mod service with no bad-reputation hosts.
  • Behaviour matches a standard Inno Setup installation.
Points against
  • Unsigned installer, so the publisher cannot be verified.
  • Code protected with .NET Reactor, which hides its contents.
  • One machine-learning engine flagged the file.
  • First seen on Nov 6, 2026.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 3 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete
  • 3isolated sandbox runs
  • 13sandbox rule tags
  • 5spawned processes
  • 2network contacts
  • 13filesystem & mutex artifacts
Runtime behaviour

What this file did when executed

This file was detonated in 3 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

1
  • VT: CLEANclean

Techniques observed in the sandbox

13

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

  • T1027· Obfuscated code
  • T1027.002· Obfuscated code
  • T1033· Reads user info
  • T1036
  • T1055· Process injection
  • T1070· Covers its tracks
  • T1071· Application protocol
  • T1082· System recon
  • T1129· Loads modules
  • T1497· Sandbox evasion
  • T1553
  • T1553.002
  • T1574· Execution hijack

Observed activity

Processes started
5

Programs the file ran, with their command lines.

  • BET-Setup.exe"C:\Users\<USER>\Desktop\BET-Setup.exe"
  • BET-Setup.tmp"C:\Users\<USER>\AppData\Local\Temp\is-6AM3IRMBNR.tmp\BET-Setup.tmp" /SL5="$50154,34832750,863232,C:\Users\<USER>\Desktop\BET-Setup.exe"
  • BET.exe"C:\Program Files\Balatro Essentials Toolkit\BET.exe"
  • BET-Setup.exeC:\Users\<USER>\AppData\Local\Temp\is-DOHA0ATQ6I.tmp\BET-Setup.tmp /SL5=$50154,34832750,863232,C:\Users\<USER>\Downloads\BET-Setup.exe
  • BET-Setup.exe"C:\Users\user\Desktop\BET-Setup.exe"
Network contacts
2

2 hosts, listed as 1 domain, 1 address, 15 links. Links show the host and path only.

  • Domainnew.balatromp.com
  • IP address104.21.33.202
  • URLhttps://new.balatromp.com/api/mods
  • URLhttps://new.balatromp.com/api/blog/latest
  • URLhttps://new.balatromp.com/api/mods/profiles
  • URLhttps://new.balatromp.com/api/launcher/latest
Show all 17 entries for network contacts
  • URLhttps://new.balatromp.com/api/mods/Abbienanigans
  • URLhttps://new.balatromp.com/api/mods/AIJTeam-All_in_Jest
  • URLhttps://new.balatromp.com/api/mods/Bundles-Of-Fun
  • URLhttps://new.balatromp.com/api/mods/SirMaiquis-FinalBoss
  • URLhttps://new.balatromp.com/api/mods/JoStro-JSUtils
  • URLhttps://new.balatromp.com/api/mods/My-Singing-Jokers
  • URLhttps://new.balatromp.com/api/mods/SleepyG11-Rulers
  • URLhttps://new.balatromp.com/api/mods/epixium-Slop_Factory
  • URLhttps://new.balatromp.com/api/mods/Foo54-SynthB
  • URLhttps://new.balatromp.com/api/mods/Simple_dev-TargetedRerolls
  • URLhttps://new.balatromp.com/api/mods/imbored
Files
12

Files the file created, changed or deleted.

  • WrittenC:\Users\<USER>\AppData\Local\Temp\is-6AM3IRMBNR.tmp\BET-Setup.tmp
  • WrittenC:\Users\<USER>\AppData\Local\Balatro Essentials Toolkit\startup.guard
  • WrittenC:\Users\<USER>\AppData\Local\Balatro Essentials Toolkit\logs\2026-11-06_080802.log
  • WrittenC:\Users\<USER>\AppData\Local\Balatro Essentials Toolkit\profiles.json
  • WrittenC:\Users\<USER>\AppData\Local\Balatro Essentials Toolkit\config.json
  • WrittenC:\Users\<USER>\AppData\Local\Balatro Essentials Toolkit\mod_cache\layout_generation
Show all 12 entries for files
  • WrittenC:\Users\<USER>\AppData\Local\Balatro Essentials Toolkit\mod_index_cache.json
  • WrittenC:\Users\<USER>\AppData\Local\Temp\is-DOHA0ATQ6I.tmp\BET-Setup.tmp
  • WrittenC:\Users\<USER>\AppData\Local\Temp\is-S855MX87YB.tmp\_isetup\_setup64.tmp
  • WrittenC:\Users\user\AppData\Local\Temp\is-B0SFZ4RPU8.tmp
  • WrittenC:\Users\user\AppData\Local\Temp\is-B0SFZ4RPU8.tmp\BET-Setup.tmp
  • DeletedC:\Users\<USER>\AppData\Local\Balatro Essentials Toolkit\startup.guard
Registry and auto-start
3

Settings the file changed, including ways to start again after a restart.

  • SetSoftware\Microsoft\RestartManager\Session0000\Owner
  • SetSoftware\Microsoft\RestartManager\Session0000\SessionHash
  • SetSoftware\Microsoft\RestartManager\Session0000\Sequence
Mutexes
1

Named locks a program uses so only one copy runs; malware families often reuse them.

  • Local\SessionImmersiveColorMutex
Sandbox background — not the file
4

The analysis machine's own processes and connections, recorded in every run.

  • VM hosta1672.dscr.akamai.net
  • VM hosteip-terr-na.cdp1.digicert.com.akahost.net
  • VM hostnexusrules.officeapps.live.com
  • VM host162.159.36.2
Dropped payload

Files this sample writes at runtime

This file drops 6 children at runtime. None are currently flagged malicious in our cache. 6 have no saved verdict and were not checked; that is missing coverage, not a finding.

6 not checked
  • 15e0957ddf10b2ac19fc…3cf22eNot checked
    no saved verdict
  • 5c81a03c3fa75df8bdbf…9b550dNot checked
    no saved verdict
  • 39485ed831ec25e1ad02…2ad4c5Not checked
    no saved verdict
  • d4735e3a265e16eee03f…13ab35Not checked
    no saved verdict
  • 6997465a4156179c75a0…f4573cNot checked
    no saved verdict
  • 37953192512b31ca5613…911e1eNot checked
    no saved verdict

Chapter 04

Technical details

1 of the 69 antivirus engines that checked it flags it; no publisher signature.

Sources checked

Every check behind this verdict

6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 75 enginesCompleteWorth noting: 1 of 69 engines flagged it · 6 gave no result · treated as non-decisive Details for antivirus engines
Sandbox runVirusTotal sandboxes · CAPE Sandbox, VirusTotal Jujubox, ZenboxComplete3 runs: 1 clean, 2 without a verdict Details for sandbox run
Contacted hostsMalwareTips URL scannerComplete5 contacted hosts checked Details for contacted hosts
Signature rulesYARAify community rules + MalwareTips rulesCompleteRisk signal: 2 MalwareTips behaviour rules Details for signature rules
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match

Engines that flagged it 1

The saved verdict treats these detections as likely false positives.

  • DeepInstinctMALICIOUS

File fingerprint

Last analyzed
Nov 11, 2026, 4:28 AM UTC
SHA-256
bd571f0e9d46426d2626d63c44416be017a56bbe448c13d0af89796947c35b4a
SHA-1
232feebe323ae7317d9c2817ffcc4238b464e255
MD5
43a5ddf65e5c748069b32f0c9afb0329

About this file

BET-Setup.exe says it is Balatro Essentials Toolkit Setup (Balatro Essentials Toolkit), 36.1 MB.

Claims to be
Balatro Essentials Toolkit Setup (Balatro Essentials Toolkit)From the file's own version information, written by whoever built it.
Type and size
Win32 EXE · 36.1 MB
Signer
UnsignedNo code signature.
First seen
Nov 6, 2026On VirusTotal.
Submitted by
18 distinct sources
Packer
.NET Reactor 2.X-3.X (DetectItEasy protector)Packing hides code; legitimate installers use it too.
Entropy
6.40 of 8

First scanned

Antivirus consensus

1 of 69 engines flagged this file

1 malicious0 suspicious68 not flagged6 no result

6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

  • Tier-118 engines
    0flagged
  • Tier-235 engines
    1flagged
  • Low-trust16 engines
    0flagged
These detections were treated as likely false positives in the saved verdict.
View all 75 engine results
  • DeepInstinctMalicious: MALICIOUS
  • AcronisClean
  • AhnLab-V3Clean
  • AlibabaClean
  • alibabacloudClean
  • ALYacClean
  • Antiy-AVLClean
  • APEXClean
  • ArcabitClean
  • AvastClean
  • Avast-MobileNo result
  • AVGClean
  • AviraClean
  • BitDefenderClean
  • BitDefenderFalxNo result
  • BkavClean
  • CAT-QuickHealClean
  • ClamAVClean
  • CMCClean
  • CrowdStrikeClean
  • CTXClean
  • CylanceClean
  • CynetNo result
  • DrWebClean
  • ElasticClean
  • EmsisoftClean
  • ESET-NOD32Clean
  • F-SecureClean
  • FortinetClean
  • GDataClean
  • GoogleClean
  • GridinsoftClean
  • huorongClean
  • IkarusClean
  • JiangminClean
  • K7AntiVirusClean
  • K7GWClean
  • KasperskyClean
  • KingsoftClean
  • LionicClean
  • MalwarebytesClean
  • MaxSecureClean
  • McAfeeDClean
  • MicrosoftClean
  • MicroWorld-eScanClean
  • NANO-AntivirusClean
  • PaloaltoClean
  • PandaClean
  • RisingClean
  • SangforClean
  • SentinelOneClean
  • SkyhighClean
  • SophosClean
  • SUPERAntiSpywareClean
  • SymantecClean
  • SymantecMobileInsightNo result
  • TACHYONClean
  • tehtrisNo result
  • TencentClean
  • TrapmineClean
  • TrellixENSClean
  • TrendMicroClean
  • TrendMicro-HouseCallClean
  • TrustlookNo result
  • VaristClean
  • VBA32Clean
  • VIPREClean
  • VirITClean
  • ViRobotClean
  • WebrootClean
  • XcitiumClean
  • YandexClean
  • ZillyaClean
  • ZoneAlarmClean
  • ZonerClean
Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

2 heuristics
MITRE ATT&CK profile
Execution× 1Defense evasion× 1
Behavior heuristics
Deterministic patterns derived from scan data and observed runtime behavior
  • ProcessInjection
    T1055
    low

    VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.

    Evidence
    T1055 (sandbox MITRE mapping)
  • DropperNetworkProfile
    T1105T1027
    high

    Unsigned, packed PE with sandbox-observed network activity. The packing step hides the payload until execution; the network call fetches / reports for the next stage. Classic dropper / stager behaviour.

    Evidence
    new.balatromp.com
PE forensics

Section entropy & packers

A known packer signature (UPX / Themida / VMProtect / etc.) matched this file. Packers aren't malicious on their own, but most malware uses them.

ent 6.40Likely packed
Section entropy11 sections
.text
6.38
.itext
6.04
.data
5.18
.bss
0.00
.idata
4.82
.didata
2.76
.edata
1.34
.tls
0.00
.rdata
1.38
.reloc
6.70
.rsrc
7.07
0.0Packed threshold 7.28.0
Detected packers
.NET Reactor 2.X-3.X (DetectItEasy protector)

Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
18
Moderate upload volume.
Total submissions
21
Includes repeat uploads by the same source.
First seen
4d ago
Nov 6, 2026
Prevalence quadrant
Rare · New
Needs evidence-led scrutiny
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is BET-Setup.exe safe?
We found nothing harmful in BET-Setup.exe. 1 of the 69 antivirus engines that checked it flags it; after weighing the other evidence we treat that alert as false alarms. Install it only if it came from the developer's own website or an official app store.
What is BET-Setup.exe?
BET-Setup.exe is a software installer, about 36.1 MB. Its version information says it is “Balatro Essentials Toolkit Setup” (Balatro Essentials Toolkit). Version information is written by whoever built the file, so it is a claim, not proof of who made it. VirusTotal first saw it on Nov 6, 2026.
How many antivirus engines detected BET-Setup.exe?
1 of the 69 antivirus engines that checked it flags BET-Setup.exe (Deep Instinct). We weigh which engines flagged it and what else the scan found, not just the count.
What is the SHA-256 hash of BET-Setup.exe?
The SHA-256 fingerprint of BET-Setup.exe is bd571f0e9d46426d2626d63c44416be017a56bbe448c13d0af89796947c35b4a, and its MD5 is 43a5ddf65e5c748069b32f0c9afb0329. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
Is it safe to install BET-Setup.exe?
We found nothing harmful in BET-Setup.exe. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.
How up to date is this analysis of BET-Setup.exe?
This report reflects the scan on Nov 11, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Recent reports on other files with the same rating.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.