🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a1dbf3d668f6935658748003eb4e4c1b4d5b01be1390408fc624a7b328ae23b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a1dbf3d668f6935658748003eb4e4c1b4d5b01be1390408fc624a7b328ae23b
SHA3-384 hash: eb182678ff64f990f66252ff05965c6e970edbfc90867bc1ec52d5029931848878ba4992edf1613f6bf8a4b8e4312b0e
SHA1 hash: 0c3a64155598707cee735aef6468685e3c3298a8
MD5 hash: 97f34a4c5946851fb9f717b8d8e04dcb
humanhash: cardinal-angel-california-solar
File name:trx38.zip
Download: download sample
File size:695'073 bytes
First seen:2025-02-24 09:00:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:9J9PS6bzKT3aPic4RG37a18tlvlxjNzrfeiAmddMjgC:9bPZXEUic4Eraubvl/zDeiAm/ogC
TLSH T1EFE4336F5CA46475F269E43B05E52DDAF705831BEF23B161D12598BE07ACD0CB060B8A
Magika zip
Reporter skocherhan
Tags:donutloader zip


Avatar
skocherhan
http://xingpai.weilay.com.cn/trx38.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
24
Origin country :
GB GB
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:hypertrm.dll
File size:633'856 bytes
SHA256 hash: 586d5d290b153334e298d033f74c8793fcdc76cce898ed282e14fb05e2f142ef
MD5 hash: 83eacc0f796782931c7deee2aff45888
MIME type:application/x-dosexec
File name:MaskDoc.hjkhkjhkjhg
File size:24'576 bytes
SHA256 hash: 50f293aeaf61f7262f38911f3db2b817604661704ff75bc0d58435e63e20be15
MD5 hash: 7bd122f622d85243d9de8ae0349d416b
MIME type:application/x-dosexec
File name:png.1413131
File size:0 bytes
SHA256 hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD5 hash: d41d8cd98f00b204e9800998ecf8427e
MIME type:inode/x-empty
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Dropper.Agent.AVHF.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6795979abb54c654530111f2
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/0a1dbf3d668f6935658748003eb4e4c1b4d5b01be1390408fc624a7b328ae23b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a1dbf3d668f6935658748003eb4e4c1b4d5b01be1390408fc624a7b328ae23b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-10-31 10:31:12 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bio36plgr5utkzmhjaad5nheyg2nlma34e4qich4mjfhwmuk4i5q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery upx
Link:
https://tria.ge/reports/250224-l4lqyswmv2/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a1dbf3d668f6935658748003eb4e4c1b4d5b01be1390408fc624a7b328ae23b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:InstallShield2000
Create hunting rule
Author:malware-lu
Rule name:Suspicious_Latam_MSI_and_ZIP_Files
Create hunting rule
Author:eremit4, P4nd3m1cb0y
Description:Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 0a1dbf3d668f6935658748003eb4e4c1b4d5b01be1390408fc624a7b328ae23b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3450648/
  
Delivery method
Distributed via web download

Comments