🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1deb54342a1eb87a6049decb67ba820e64b1bb9c333be62323a2c136080d2e41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1deb54342a1eb87a6049decb67ba820e64b1bb9c333be62323a2c136080d2e41
SHA3-384 hash: e24eb0b1de5e37aa796f2c9480b13ae04d9acf5f3d55c70e9ebd05f7aafc6f6a0f8d6e1d043dd621499186aae8b26446
SHA1 hash: e93ca0455681a1f5a528dec1620e9d75bcb0540c
MD5 hash: 737c03fe99457d3f4d2fc8281377d524
humanhash: hydrogen-july-enemy-burger
File name:1deb54342a1eb87a6049decb67ba820e64b1bb9c333be62323a2c136080d2e41
Download: download sample
File size:35'729 bytes
First seen:2026-11-01 20:54:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:gfqR1wTDncMFHI2Rb+oGlqcWRCGeq63ZHjtQSUl0c/ffzXfuG541dV/sa/s9tXo5:gfqPwzFHIuGPWRvkQSmzPuh1Hfs9NPED
TLSH T1EEF2A63E5A9D5D1DCB1BC136E31AF12CE4D2C02201B5EA1B6F528380E5EF19A6636F17
Magika zip
Reporter Tatamis
Tags:ContagiousInterview DPRK github zip


Avatar
Tatamis
Contagious Interview (publicly tracked fake job-interview campaign). Observed statically in operator-controlled GitHub repositories, October 2026; nothing executed, no attacker host contacted. archive from operator repository Vercel-ip22/project-zip (java.zip), git blob 3f39f54d99d36404538b0e5d3da333a2b78e34ce

Intelligence

File Origin
# of uploads :
1
# of downloads :
4
Origin country :
RO RO
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/100fe302-d808-429e-a32a-b3e086372866/
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae82e003c74f575e61ce8c8
Tags:
infosteal
Verdict:
Malicious
File Type:
zip
First seen:
2026-11-01T18:54:00Z UTC
Last seen:
2026-11-02T19:59:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1deb54342a1eb87a6049decb67ba820e64b1bb9c333be62323a2c136080d2e41/results?tab=lookup
Score:
1%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/1deb54342a1eb87a6049decb67ba820e64b1bb9c333be62323a2c136080d2e41
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Zip Archive
Link:
https://app.malva.re/file/737c03fe99457d3f4d2fc8281377d524
Gathering data
Threat name:
Package.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-11-02 00:13:47 UTC
File Type:
Package (Java)
Extracted files:
43
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dxvvinbkd24huycj33fwpoucbzsldo44gm56mizdulatmcanfzaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 1deb54342a1eb87a6049decb67ba820e64b1bb9c333be62323a2c136080d2e41

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4050284/

Comments