🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22874b6a6184d2f77ba2c24b8948fe2af261aea99d641423e4c69644b994e6ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22874b6a6184d2f77ba2c24b8948fe2af261aea99d641423e4c69644b994e6ea
SHA3-384 hash: d5ce1475b125b47657351978271c91cc87b4319d93aa2b8f3434dae683e9cb614eec1b9859bfb1757deb41dbf5a84a64
SHA1 hash: 60326febdebb6f5c791b454fbda10315601b8be0
MD5 hash: 3a8a75ed5c43572b70fe1a4363c9497e
humanhash: fillet-finch-harry-speaker
File name:mbupload-pdewblml.bin
Download: download sample
File size:11'267'832 bytes
First seen:2026-10-19 03:07:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:roslj+RxnaqYfoYhvhVo6PfrlPW2zvT6VpsaurXkJWcaiJ5uQdQnBhK:rflinDUh7o67QaT6vslTkJWlQdQnBQ
TLSH T1A3B633E8C6413CCDE8C7BA3D87E819EAE9C9CA378A10D5E6D145A3E024BE1FD1C51457
TrID 66.6% (.XPI) Mozilla Firefox browser extension (8000/1/1)
33.3% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter wristhulk
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
US US
File Archive Information

This file archive contains 31 file(s), sorted by their relevance:

File name:bot_actions.cpython-311.pyc
File size:9'157 bytes
SHA256 hash: 3fa32c3ed96eaa0aa4d04786a48a2385f150356d17163af0d90a212c0242439d
MD5 hash: 60a1e896591a533c98e28e878d75203a
MIME type:application/octet-stream
File name:env.cpython-311.pyc
File size:5'219 bytes
SHA256 hash: f919ff801663e41a070593e90ff3f21be0df7ead8f7ccad72f7e1a1062e54824
MD5 hash: a1f2f363ac2905c5f3aa1ff75d916006
MIME type:application/octet-stream
File name:gateway.cpython-311.pyc
File size:4'923 bytes
SHA256 hash: 6217238121b6f9e1aa0c7d61e803d5b1b76f2c69db2c6c82e8a3764a51d1b434
MD5 hash: 6793eacb122722be483e725432d54088
MIME type:application/octet-stream
File name:vault.cpython-311.pyc
File size:8'483 bytes
SHA256 hash: 9f17b888e92fd2343a48bcf04a8821e09a433a2ebb87d93295532eaefa0094a4
MD5 hash: cc7391c7f1d0575a1d730b889b5849b9
MIME type:application/octet-stream
File name:run.bat
File size:798 bytes
SHA256 hash: 04840b6889f566aac54af9ce8db23423324df2f60aae05d6a401150ab3f6ba9f
MD5 hash: 8deee9ab3d1509c86ac8ff920b31b727
MIME type:text/x-msdos-batch
File name:about.cpython-311.pyc
File size:3'993 bytes
SHA256 hash: 43a2a91c2a37fa87ce5b2f64dadb729b1c23a45692a65cbc3f51ffe5c05f71d1
MD5 hash: 60e515c32155a09e31d4d2d3c3cb6e5c
MIME type:application/octet-stream
File name:ui.cpython-311.pyc
File size:10'337 bytes
SHA256 hash: 678bb0968041b24a3271f5e3db8112fc56266a093a23a42163ab455c04e637de
MD5 hash: e7e26b9ec73997d6f7b8ecbcc2f2638d
MIME type:application/octet-stream
File name:executor.cpython-311.pyc
File size:7'548 bytes
SHA256 hash: 4580b9b085f78b09f189bd4b3b583093db0602c863f4cbacb515ed9c5e0d2071
MD5 hash: 39f696bc39a852e672da1d1c8e30703e
MIME type:application/octet-stream
File name:install.cpython-311.pyc
File size:3'569 bytes
SHA256 hash: 0f373e524aafdde338dee620c2dcbc8ee10dc4da38b95c45817f82ff77bdac23
MD5 hash: 5cf6c5b12c319d6419bdc0ce03acb6ce
MIME type:application/octet-stream
File name:config.cpython-311.pyc
File size:3'135 bytes
SHA256 hash: a9be630064df6402ce239dfa55fa67049bbadaa5c0f88697ce0859302b32ccd8
MD5 hash: 90e4c2063c49599f3525a8e53b110ee1
MIME type:application/octet-stream
File name:settings.cpython-311.pyc
File size:2'834 bytes
SHA256 hash: 156f70c7d7319656b3c4ad2a2c5c38fc841ab86465f1e906db0c7eec3451a591
MD5 hash: c4affc039ba69c9d2cb75c99cc54d352
MIME type:application/octet-stream
File name:__init__.cpython-311.pyc
File size:9'769 bytes
SHA256 hash: 10ff921505a8e85480dbdea0122accede06851966a7e2ae241a982696872253b
MD5 hash: 57ecfab834e1dd7baa96dd10d6877e77
MIME type:application/octet-stream
File name:main.cpython-311.pyc
File size:6'433 bytes
SHA256 hash: a7d62152b64efab9bc126045804a00665890e537b04560adfcdf81f3807e7bdb
MD5 hash: e0445a9f4d56332cd1fb03620778187c
MIME type:application/octet-stream
File name:settings.yml
File size:200 bytes
SHA256 hash: 7b85530e6b0728a814061ca38ac6aab727e82b4cba56a34c7ee8e168edf187ec
MD5 hash: c0bb4e8a2bc6e02d7cf0c8149c76867c
MIME type:text/plain
File name:requirements.txt
File size:84 bytes
SHA256 hash: fa5637fee9cca92ac852e60c29a4898e85e8a29e8a153c8f3510954071122cd2
MD5 hash: 150bc45a04eddbd50ac0a297dc8f0e7e
MIME type:text/plain
File name:gateway.py
File size:2'672 bytes
SHA256 hash: 6880b1dd8b4f3a61be5136d98d724bb658763a5734d434708a567c2a8de81ac6
MD5 hash: 6641436ed5085597f6ceeeaf4decfdae
MIME type:text/x-python
File name:install.py
File size:1'786 bytes
SHA256 hash: 6cb699a2eb307f831555bb7919ac055835cce533f96cc1c6ed821632e4163806
MD5 hash: 80fb1b06caf6f427cd3f439bd0696368
MIME type:text/x-python
File name:ui.py
File size:5'780 bytes
SHA256 hash: 4d946f1c72d982b5a7401be2e5f1b307ff4114dda27b800f0464431d1862c216
MD5 hash: 22bf7c972bca61f383e59650b7ce4813
MIME type:text/x-python
File name:executor.py
File size:5'013 bytes
SHA256 hash: 46913b5ac710617a6f0ffcac96c38156894a9d6fd8ba343e87e111f823d4909a
MD5 hash: d34761b36fd0ae51e19c50b4ddb57c82
MIME type:text/x-python
File name:config.json
File size:318 bytes
SHA256 hash: e9997aa46eeddd5f3aac258db733b90feeb659c732fc65a4f1cfb905d9c8c19a
MD5 hash: 88890e4c936ddbf411915526693ee61d
MIME type:application/json
File name:__init__.py
File size:5'258 bytes
SHA256 hash: 048bd1e412bd3970f1ba4af3a32adc21b1fe44064f2f20034090408073500848
MD5 hash: af3a9ad624ba57a483a0cc7178f039d9
MIME type:text/x-python
File name:main.py
File size:4'215 bytes
SHA256 hash: c29d85f313baa088a9e86a102516ae6d32f6b35be8965d5ffb1e20040eb8b5b9
MD5 hash: fe81e69b0a1e0daef102e21032d4bfc2
MIME type:text/x-python
File name:settings.py
File size:1'531 bytes
SHA256 hash: 4d9ee5b06ac4d6536a1bf8929dbe6c64f1303d46322eee1778009766a0e128d8
MD5 hash: 4bb5c6363e39118aa9cf54bf3e70cf1c
MIME type:text/x-python
File name:about.py
File size:2'580 bytes
SHA256 hash: 7ee64a9f88b3d7cf7130f7a1a685df4ac540d58f64ddd82d94b267c544d844c6
MD5 hash: 89201228290ad1a08cbe892ffaf0ad45
MIME type:text/x-python
File name:bot_actions.py
File size:4'987 bytes
SHA256 hash: bf2264a2e14877ba6800ce9cff8f79c1444bd1d0a4a945441bd26bc5a8ed9200
MD5 hash: fa5666c0702798733394bf0695802d25
MIME type:text/x-python
File name:store.bin
File size:11'249'149 bytes
SHA256 hash: 85e60fa44f02780b933da5c5a403c28d65d13b9592e6cb987bf56e11f67ba381
MD5 hash: 5fde0ce16bbc83eaabe48b112bf1f6ce
MIME type:application/zip
File name:env.py
File size:2'879 bytes
SHA256 hash: 2b52256cf03f2483f5574bdff4b1d9b948979cc77f065db4860919148f5a992f
MD5 hash: 869f94478ac8b238cdb8f1f1af687c26
MIME type:text/x-python
File name:changelog.txt
File size:85 bytes
SHA256 hash: c3a718d433a22ba7b83632305dd3e8903814054870ad3abc1e929fb1a07f3a09
MD5 hash: 29ae409ddbfd6ee1d4d66994e3322bb5
MIME type:text/plain
File name:vault.py
File size:4'195 bytes
SHA256 hash: 62186959889737ef11ef1ddae71d7011c7a6f9272a9f6ad909bd27bb37ff2f4c
MD5 hash: 11bb1d94d8a4f73595e7bcfb1146212f
MIME type:text/x-python
File name:run.sh
File size:232 bytes
SHA256 hash: e1b61c8ced6ce94228fb61f4dc20618dfc1d1007ba3b3d9fdc610adb5a595301
MD5 hash: 6d5c94f5c9a49095bffd81e6f201a887
MIME type:text/x-shellscript
File name:config.py
File size:1'654 bytes
SHA256 hash: acfb8905476f6096b598c52981169fba6436b68c145a878c9cbd843f778e6266
MD5 hash: e729711c15e3e656f7f8c2bdc6a3a78a
MIME type:text/x-python
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5c141d32-fac9-46bc-9c56-0c053ebd17d6/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad1ba3b6f551121ba16820d
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/22874b6a6184d2f77ba2c24b8948fe2af261aea99d641423e4c69644b994e6ea
Verdict:
Unknown
File Type:
zip
First seen:
2026-10-19T03:44:00Z UTC
Last seen:
2026-10-19T04:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/22874b6a6184d2f77ba2c24b8948fe2af261aea99d641423e4c69644b994e6ea/results?tab=lookup
Score:
3%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/22874b6a6184d2f77ba2c24b8948fe2af261aea99d641423e4c69644b994e6ea
Verdict:
Malware
YARA:
4 match(es)
Tags:
DeObfuscated Executable PDB Path PE (Portable Executable) PE File Layout PowerShell T1027 T1059.001 T1059.005 Zip Archive
Link:
https://app.malva.re/file/3a8a75ed5c43572b70fe1a4363c9497e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22874b6a6184d2f77ba2c24b8948fe2af261aea99d641423e4c69644b994e6ea/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-19 03:08:36 UTC
File Type:
Binary (Archive)
Extracted files:
1440
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ekduw2tbqtjpo65cyjfyssh6flzgdlvjtvsbii7ey2lejomu43va._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/261019-gfv79sfs3y/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/22874b6a6184d2f77ba2c24b8948fe2af261aea99d641423e4c69644b994e6ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 22874b6a6184d2f77ba2c24b8948fe2af261aea99d641423e4c69644b994e6ea

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3952159/
  
Delivery method
Distributed via web download

Comments