MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a9d3bb7fe42cb3fe8df5347f6e92a5f770d13d9d2b5dd47d3e09f7f8a2acd3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a9d3bb7fe42cb3fe8df5347f6e92a5f770d13d9d2b5dd47d3e09f7f8a2acd3d
SHA3-384 hash: 591ac9c505a9de07dc2b0cbbc046a0a4e8660e5a6fca6d6a50151900045a4a533ad8f970b118f0e549aa036a0db709d6
SHA1 hash: 3db54a1663b8d2fb28397df44a1e6c3cc2867471
MD5 hash: 26ebd5d514a58f878c15d70b1bd37850
humanhash: kitten-floor-fourteen-march
File name:$RAK7IC4.zip
Download: download sample
File size:11'992 bytes
First seen:2026-05-02 18:58:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 192:n7lQwMqlCjNBkSkM2IcHUhD3Xn1vFtfpLMLUSUKnhi3kc55VvhRVqIsoP5r4gS7e:n7awMqWBQTHcD3X1v3feLUSUKnhm7PZ3
TLSH T11232C0467742FA23E072309433AF1B5D86433AC1AB530F3A4E64A5A77EA00C73674F12
Magika zip
Reporter smica83
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
HU HU
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:IMG-691766333.png.lnk
File size:1'905 bytes
SHA256 hash: a82f49e2bd5121370f9e3495cdcf1508c8fdfad2e9ef590daf9a933e2b3cebdd
MD5 hash: c1fc0d27b897140f9868fbaa912599d3
MIME type:application/octet-stream
File name:MP-687248802.mp4
File size:10'769 bytes
SHA256 hash: 0c5e5f7ebe79db451dffe13137ee3bbab5e25f573311b4ae36a7aa897f784e41
MD5 hash: d44a53d64264e8cb5d8cdeca1d41ad28
MIME type:application/octet-stream
Vendor Threat Intelligence
Gathering data
Detection(s):
Sanesecurity.Foxhole.Zip_png.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.28759.LnkHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30517.LnkHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30537.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLook.20220523.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.Guinnesses.M2.20220719.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
LNK File
Link:
https://app.docguard.net/2a9d3bb7fe42cb3fe8df5347f6e92a5f770d13d9d2b5dd47d3e09f7f8a2acd3d/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade powershell
Link:
https://www.filescan.io/uploads/69f649902fcb905ec27a75fa/reports/2fcf168e-4fec-4a82-993f-98f9190034d1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2a9d3bb7fe42cb3fe8df5347f6e92a5f770d13d9d2b5dd47d3e09f7f8a2acd3d
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2a9d3bb7fe42cb3fe8df5347f6e92a5f770d13d9d2b5dd47d3e09f7f8a2acd3d
Details
Hidden Powershell
Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.
Verdict:
Malicious
File Type:
zip
First seen:
2026-05-02T16:19:00Z UTC
Last seen:
2026-05-03T09:11:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2a9d3bb7fe42cb3fe8df5347f6e92a5f770d13d9d2b5dd47d3e09f7f8a2acd3d/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a9d3bb7fe42cb3fe8df5347f6e92a5f770d13d9d2b5dd47d3e09f7f8a2acd3d/
Threat name:
Shortcut.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-02 12:32:23 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
9 of 35 (25.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fkotxn76ilft72g7knd7n2jkl53q2e6z2k252r6t4cpx7crkzu6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a9d3bb7fe42cb3fe8df5347f6e92a5f770d13d9d2b5dd47d3e09f7f8a2acd3d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands
Rule name:LNK_sospechosos
Create hunting rule
Author:Germán Fernández
Description:Detecta archivos .lnk sospechosos
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_PowerShell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to powershell inside an lnk file, which is suspicious
Rule name:SUSP_LNK_SuspiciousCommands
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects LNK file with suspicious content

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments