🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4
SHA3-384 hash: ba7065b6bfbbca401b29668c7d0d916f4284f4067bf3e31d3de35c803475305b6bc986e4f1b31a0a9c02ac8ffa64fc30
SHA1 hash: 5ea3a98fe78f8846abd77657ef989f1a5b574459
MD5 hash: c7d8e34022eb1ad3e22b0fdf1e9c9ab7
humanhash: south-kitten-johnny-dakota
File name:131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4.bin
Download: download sample
File size:845'599 bytes
First seen:2026-09-12 06:17:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:t3nEcoOP8kY8eOKhEt+FP/4KFdSKNwzTVXuq3poEUx:hnCCt+FP/9FdE+ypoDx
TLSH T12D052336DB8D5C55C327B17C584CB81D09CAC2A8C1D17C7AA59A61ED8B7FAD48332AC3
Magika zip
Reporter whack_sh
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
US US
File Archive Information

This file archive contains 36 file(s), sorted by their relevance:

File name:PixelOperatorMono8.woff2
File size:4'892 bytes
SHA256 hash: 624123c87e119763bba1c92cdb063ba562cc2f4e20eaac2bee4864ba5b704242
MD5 hash: 8084f3aa33dc54bba517c4f6a76f7019
MIME type:application/octet-stream
File name:Assets.car
File size:171'272 bytes
SHA256 hash: aa4cc30ef72abbf93ab1bd7152d3dec45b4a6f149e8b6963a33386737cf9be1b
MD5 hash: 4c0cb3b3a5c6cf13b0485d7b4601dc6c
MIME type:application/octet-stream
File name:RobotoMono-Medium.woff2
File size:41'880 bytes
SHA256 hash: 15bcdc33f9e3d9e04ceb89cae999a1224b2db364cafab774eb4c025ffe0e0968
MD5 hash: 7360e80f1253ef085ca530e126232b68
MIME type:application/octet-stream
File name:recovery.png
File size:18'771 bytes
SHA256 hash: 141fff225c118cf1dba506933766c6ca0f4eb398455a0e50ee61f0518e775d52
MD5 hash: 400606b0f5d23b370ca8491708a5a2d6
MIME type:image/png
File name:TTSatoshi-Medium.otf
File size:318'760 bytes
SHA256 hash: 7de6dae5dbfaa662ef8901ded1f49c04d216d77d798e2aa41b0e649590206e6e
MD5 hash: e727cfbd3790350ff5b5e17e680ac354
MIME type:font/sfnt
File name:uni-error.svg
File size:1'230 bytes
SHA256 hash: 6b4b810de90ed28e3e23317f501d1f63c57b1d68d91c0b9d3304bbd8437981c5
MD5 hash: 7742c6fda1d8c753aeb3436a2d3b9626
MIME type:image/svg+xml
File name:cogs.svg
File size:1'354 bytes
SHA256 hash: 1ce92303139b55d378382c63e608800f8ef6de40ccd5cc4898503de62cd713cd
MD5 hash: 6c0ad7fe0e97f98d8fcdb04a22a90bd3
MIME type:image/svg+xml
File name:TTSatoshi-DemiBold.otf
File size:312'024 bytes
SHA256 hash: fcefb74239de3b1e766c2bf57d257d7a5bdcb2502f5bb1e8e4205d12662b9113
MD5 hash: 92196fc08fa4a38e62c9f3bee1764f3a
MIME type:font/sfnt
File name:guide.svg
File size:521 bytes
SHA256 hash: e5689b13aa3874a7cfebf563f30da45beda693cada6a81497e07caed64abe542
MD5 hash: b6d6d2fd584e6ca5c53d2a5c5ca9155c
MIME type:image/svg+xml
File name:fonts.css
File size:638 bytes
SHA256 hash: 3194c2c2ac0f7c70a5f82e4bdf9d9ecd019ab906f413cc1b17bdc6fa6cfcfeeb
MD5 hash: cb7ebd8785ed1d8528b52867dc40fe93
MIME type:text/plain
File name:swap.svg
File size:458 bytes
SHA256 hash: 18816db85c283f7309b4c52a5c08e33d1eb1317131f3fa1661965a7673785b7e
MD5 hash: 91d598c9e884b3539f8a5bb263e21be8
MIME type:image/svg+xml
File name:spinner.svg
File size:439 bytes
SHA256 hash: fef93e6a206359958e40550892c61c3a4a8ef7adf5ec61fbd1739ff2adcf186e
MD5 hash: 23f6b71b93c35d50dc217b59a88860fa
MIME type:image/svg+xml
File name:end.html
File size:9'559 bytes
SHA256 hash: cc3e37fb4b4896927ee0075aa6e1d4bc94ddaf96f54d270a8588aa794332882f
MD5 hash: d708d6aaf6df260bc2d8e139aa241cd6
MIME type:text/html
File name:trezor_logo_gray.png
File size:1'184 bytes
SHA256 hash: 0dbdd5202fa2b8cae2b71e03b5373df5ab90b3d9d06d318b0120ce299759d04d
MD5 hash: b1e2e5a1d237775e6056cb80f641b962
MIME type:image/png
File name:home.svg
File size:380 bytes
SHA256 hash: 62685e7736a2c16eba805ef9364d92c20eac9142b16985c9172ef5d543741cee
MD5 hash: 88742a4eff19d11117e94802b9e809d9
MIME type:image/svg+xml
File name:RobotoMono-Medium.ttf
File size:86'820 bytes
SHA256 hash: ef762daac2ccb20a231e1febb37d7e71311e24f4f95e3db11d1fe5b836ba5ca4
MD5 hash: b090e3202375adb631519fab6bf121c2
MIME type:font/sfnt
File name:slip39-words.js
File size:9'306 bytes
SHA256 hash: e3a6eda9172dd832243513214ebc21c50719121a45b99da1cde43362a3554b95
MD5 hash: 9a0af2bfffa22d4cc9c451f85788de5e
MIME type:text/plain
File name:PixelOperatorMono8.ttf
File size:19'872 bytes
SHA256 hash: b627505e178c0c51b0ce7d432f2974fdc2064339f17fb5242b7237becad3c467
MD5 hash: 7477aa4c755ee848bdf56c6cd4983572
MIME type:font/sfnt
File name:trezor-suite.css
File size:22'714 bytes
SHA256 hash: e55b370698dfec71546b692895cc6bc6d4e0713697d6079e22d838db1e3275c5
MD5 hash: 7981892bb46e7595d6c176d3b21bf7c0
MIME type:text/plain
File name:Trezor Suite
File size:240'784 bytes
SHA256 hash: 48cc0941b4129bfaeb6948de49dc7c81456e92907b3ea6bdcef5ff186dddf200
MD5 hash: a67f456fda68ad3b34dd7c546ab4f059
MIME type:application/x-mach-binary
File name:shield.svg
File size:366 bytes
SHA256 hash: 836b2e282fcf15f30aba342d27903e2019a239224b9820aaac1566422f6385c7
MD5 hash: 759b9070f29fb571b82b19d21a9cfa8e
MIME type:image/svg+xml
File name:AppIcon.icns
File size:20'141 bytes
SHA256 hash: 0a2a6e4bf3b15ba49be065da270f9c0ea45e242587fd3f273fd4f9082f5f51e8
MD5 hash: 1c7825777f3e9cd02cebd00371ede151
MIME type:image/x-icns
File name:index.html
File size:22'219 bytes
SHA256 hash: bdbf9272eb5988c69e453a20df40f05af7fe3c487cc50330bd52b2d52b88cb6d
MD5 hash: ee9245f417a04f5d388748e8d742aeb2
MIME type:text/html
File name:eye.svg
File size:658 bytes
SHA256 hash: ec79cfb436675fd10bbba0648431b550705d95eda90305b63429737e6a191338
MD5 hash: 51ca8443089701a7a4141ae5a5fc884c
MIME type:image/svg+xml
File name:connect-device.svg
File size:64'756 bytes
SHA256 hash: 39a8f1aab80f73df8c272fa3af3e15a59b2f0d6d829f1e02121e1f6a61a4fc88
MD5 hash: b968c8df45d4c2298ca3a49a6089e79e
MIME type:image/svg+xml
File name:Info.plist
File size:1'549 bytes
SHA256 hash: ef30c47da38259adb1f3ff88a4cfe217b9cd97a64ddf60c87d7a2f3140afc911
MD5 hash: 638edad792b813f6598d17e7f333acdc
MIME type:text/xml
File name:full_logo_dark.svg
File size:3'298 bytes
SHA256 hash: 8116424beaff2f6684fa8e966a98568283ec7c2095b5d4025ec753c26adf491a
MD5 hash: 94b3c7273b8815b194179c6214c8af3d
MIME type:image/svg+xml
File name:PkgInfo
File size:8 bytes
SHA256 hash: 82502191c9484b04d685374f9879a0066069c49b8acae7a04b01d38d07e8eca0
MD5 hash: 23b7d7d024abb0f558420e098800bf27
MIME type:text/plain
File name:trezor_logo_dark.svg
File size:852 bytes
SHA256 hash: c886effd9956554a349071450f99f11f66044be282464502fd84540e5e334805
MD5 hash: c39255d175639622008c17f1c0a35f03
MIME type:image/svg+xml
File name:notification-bell.svg
File size:379 bytes
SHA256 hash: 4042fb555b1e9bb4d87269d8416100366406ae660131edd50208fe34b9dc9017
MD5 hash: 2543f192dfa8aa7f133ffd399d0a6e0c
MIME type:image/svg+xml
File name:CodeResources
File size:9'950 bytes
SHA256 hash: 9cb7b5de4f3322f10f47a73f4e2b79dc2d624dd9638c5285e399012454ac8077
MD5 hash: dae400fd5eba187fcac6ad7106474f3a
MIME type:text/xml
File name:put_seed.html
File size:65'900 bytes
SHA256 hash: e40cd1635ab3725f7b76891d7c231ab8249d7ca12fed3462121df1ae5d1e0a50
MD5 hash: 0d6ba35b848332e998f2b89f081d8b00
MIME type:text/html
File name:earn.svg
File size:767 bytes
SHA256 hash: 7e8639b0dc45c1a504903283dd0d29f52440ad45094d6b81c209f7d5ce48a016
MD5 hash: 895f6f824ff9efc2e029ee23ef098bd1
MIME type:image/svg+xml
File name:stub.png
File size:237'170 bytes
SHA256 hash: 26dfba2d5eafece92b74681327b81e6efb90c196ef0c9a4733498174477b292c
MD5 hash: a5bc8703976f3ad951ab56761d19d8d2
MIME type:image/png
File name:warning-triangle.svg
File size:394 bytes
SHA256 hash: 4297861905960e5de7ca992b70f9d409b496514151f3db9810900bbdccd59839
MD5 hash: bb7c94ddfadf76aa865de752fbe9dec2
MIME type:image/svg+xml
File name:check.svg
File size:216 bytes
SHA256 hash: 678af670ad00215faada49e908a3229303994b1e52be73b65789cfa052fa7d86
MD5 hash: 64b7887f8854edc5e6f59263d3a803f8
MIME type:image/svg+xml
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.MacOS.Stealer-GN.16594818.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4
Verdict:
Malicious
File Type:
zip
First seen:
2026-09-09T13:35:00Z UTC
Last seen:
2026-09-09T15:38:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4/results?tab=lookup
Score:
98%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
SVG Zip Archive
Link:
https://app.malva.re/file/c7d8e34022eb1ad3e22b0fdf1e9c9ab7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4/
Threat name:
MacOS.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-09 17:43:42 UTC
File Type:
Binary (Archive)
Extracted files:
54
AV detection:
9 of 36 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cmnaoeybabw35wg36tjobczjcrahw5utvmrvm26752ptt4kxvk2a._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion macos
Link:
https://tria.ge/reports/260912-hq3krsfb29/
Behaviour
Resource Forking
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4

(this sample)

  
Delivery method
Distributed via web download

Comments