🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f9acfa3a63308b30ee80a151ad179a86411e5cfe78ca281d308f0bfcb55fc5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f9acfa3a63308b30ee80a151ad179a86411e5cfe78ca281d308f0bfcb55fc5b
SHA3-384 hash: c1fe07cfc382a79ad88660d8b558ad30780d1066486efbbdab906b6c3ecc8b3408ebf2728d7ad2174c8ef626cea44784
SHA1 hash: 52cee4466a71c7b0487a5d5fab47460e891bc353
MD5 hash: 2afcd94e4449a6a5dd5f4d8d7c89d645
humanhash: sweet-twenty-blossom-pasta
File name:លិខិតអញ្ជើញជូនចំពោះឯកឧត្ដមបណ្ឌិត_សៀង_សុវណ្ណា_pdf.rar
Download: download sample
File size:3'231'037 bytes
First seen:2026-10-28 19:12:42 UTC
Last seen:Never
File type: rar
MIME type:application/vnd.rar
ssdeep 98304:S6GG7WkzBYmp7f5dZ3CYJpATqWnLwe2W2:S6GKY+j5dRxpAT7LP2
TLSH T161E5330C3AB998440DF88A0D360C172516334D6D85D6DEE4CBAD28A587E6E97C7EB373
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter smica83
Tags:HUN rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
HU HU
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:assumable.exe
File size:1'692'627 bytes
SHA256 hash: f55980e7883d4a47a3642709932c62d6bcb63517db1a24584f4ae390b95b3d54
MD5 hash: c9cda70b032a917729c388acf1a55403
MIME type:application/x-dosexec
File name:លិខិតអញ្ជើញជូនចំពោះឯកឧត្ដមបណ្ឌិត_សៀង_សុវណ្ណា.pdf
File size:1'642'071 bytes
SHA256 hash: 191f007c2fae1d69d98d22fc731ffd28726e7476f40e1b3e6d84de1519d1233a
MD5 hash: 44f362960d78f23afe6fffbbcd15ab90
MIME type:application/pdf
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/08abd7c1-2949-4b8b-9c4b-ec3b997186df/
Detection(s):
Legacy.Trojan.Agent-1388773
Create hunting rule

Legacy.Trojan.Agent-1388784
Create hunting rule

Sanesecurity.Foxhole.Rar_pdf.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.Tool.BtcMine.2790.UNOFFICIAL
Create hunting rule

Win.Exploit.Rozena-10037100-0
Create hunting rule

Win.Exploit.Rozena-10038302-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae2495849621540087c306f
Tags:
infosteal autorun rozena nsis
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm crypto fingerprint installer installer installer-heuristic masquerade microsoft_visual_cc overlay packed reconnaissance sfx
Link:
https://www.filescan.io/uploads/6ae24954691cc85de7950258/reports/081af9bd-0e22-4154-90ad-55777ea49a11/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/0f9acfa3a63308b30ee80a151ad179a86411e5cfe78ca281d308f0bfcb55fc5b
Verdict:
Malicious
File Type:
rar
First seen:
2026-10-28T05:37:00Z UTC
Last seen:
2026-10-28T07:10:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0f9acfa3a63308b30ee80a151ad179a86411e5cfe78ca281d308f0bfcb55fc5b/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Rar Archive
Link:
https://app.malva.re/file/2afcd94e4449a6a5dd5f4d8d7c89d645
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f9acfa3a63308b30ee80a151ad179a86411e5cfe78ca281d308f0bfcb55fc5b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2026-10-27 12:24:45 UTC
File Type:
Binary (Archive)
Extracted files:
137
AV detection:
18 of 36 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6nm7i5ggmelgdxibikrvulzvbsbdzop46gkfaotbdyl7s2v7rnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f9acfa3a63308b30ee80a151ad179a86411e5cfe78ca281d308f0bfcb55fc5b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments