MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 128fdd44526c4e3102421425c23e3c5a5bf49f38eb13a98eea8b08817df2a47e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	128fdd44526c4e3102421425c23e3c5a5bf49f38eb13a98eea8b08817df2a47e
SHA3-384 hash:	04aca042439cd906530a673e50e87b1ab526f2d421402c1ea9356d6f7bac549b4eab92ce0c60bce95288c406cae50463
SHA1 hash:	4f1d6b1618064109e363379170038d3543a96e7b
MD5 hash:	7b7733a794dcc45e8d146e1f6439b588
humanhash:	finch-venus-sweet-rugby
File name:	128fdd44526c4e3102421425c23e3c5a5bf49f38eb13a98eea8b08817df2a47e.bin
Download:	download sample
File size:	5'829'950 bytes
First seen:	2026-10-23 02:02:32 UTC
Last seen:	Never
File type:
MIME type:	application/zlib
ssdeep	98304:REDn3B/RLIrAZWRK6/yuosCPY9bpXC7zv0MwbhnElihP2ljbly12uLow:ORZL9Hvy9bRCHv8ElsP25bgnLo
TLSH	T1FB4633FFCEFD5A54E8270BB5800990878E7AD45F7A66C471F4850BD2B88E1EBD990132
TrID	97.6% (.DMG) Macintosh Disk image (BZlib compressed) (83000/1/20) 2.3% (.) ZLIB compressed data (best comp.) (2000/1)
Magika	dmg
Reporter	Tuxxin
Tags:	dmg

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

44

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6adaeda5afb06e650cd8cae6

Tags:

virus

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/128fdd44526c4e3102421425c23e3c5a5bf49f38eb13a98eea8b08817df2a47e

Kaspersky OpenTIP Adware

Verdict:

Adware

File Type:

udif

First seen:

2026-03-31T11:25:00Z UTC

Last seen:

2026-10-24T18:38:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/128fdd44526c4e3102421425c23e3c5a5bf49f38eb13a98eea8b08817df2a47e/results?tab=lookup

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/128fdd44526c4e3102421425c23e3c5a5bf49f38eb13a98eea8b08817df2a47e/

ReversingLabs TitaniumCloud MacOS.PUA.ScreenConnect

Threat name:

MacOS.PUA.ScreenConnect

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-06 20:29:50 UTC

File Type:

Binary (Archive)

Extracted files:

30

AV detection:

8 of 36 (22.22%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ckh52rcsnrhdcasccqs4epr4ljn7jhzy5mj2tdxkrmeic7psur7a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/128fdd44526c4e3102421425c23e3c5a5bf49f38eb13a98eea8b08817df2a47e