MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 285ecbdb10b2ae2c71f82dbbd99aa73afcbb33333208929b8b751e95a480b62a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	285ecbdb10b2ae2c71f82dbbd99aa73afcbb33333208929b8b751e95a480b62a
SHA3-384 hash:	b503852f5b92d58d26f72000026829d88e9c8ec2c49f1a1c0ece2a0a9a450b3582e1f2cabe5a904b265339b043883e14
SHA1 hash:	1f95c9fc99fca238a8981762508dd4cd8ef61485
MD5 hash:	40a841dac2ee8d0273253e33f200bb1a
humanhash:	fish-september-lactose-sodium
File name:	plikai-1.0.25.vsix
Download:	download sample
File size:	28'529'729 bytes
First seen:	2026-10-23 21:52:22 UTC
Last seen:	Never
File type:	zip
MIME type:	application/octet-stream
ssdeep	786432:/lw3xJfne9wUvcZh33nFdwWpXMGownj2OYAOG:NwBJWkbnnFNokXYvG
TLSH	T10157336B14ED005BCA36F878DCE11B53CF3AA3EBDC42F89B24EC554969F26918715A30
TrID	47.4% (.VSIX) Visual Studio Extension (23500/1/3) 23.2% (.SUBLIME-PACKAGE) Sublime Text Package (generic) (11500/1/3) 21.2% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 8.0% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	mindhas403
Tags:	DLL-Sideloading Geaix infostealer stealer vsix zip

mindhas403

Rebranded copy of the Geaix trojanized VS Code extension (same dropper as geaix-1.0.25.vsix, SHA-256 b6ac717195b74240e6c1bddf202be6bb3e11e4dd5cd4767072b6a8fdd3567a8b), served from https://plikai.com/vsix/plikai-1.0.25.vsix on 179.61.227.71 (AS399486) as of 2026-10-24. Stage 2 jli.dll d76e906a18c04826996d1f30de248e7a0e50c48814c82e9583b36c91fdf66f00, Stage 3 build.dll dd81a7c12465d70e85e59ee49c1ed9fe4c9b4d2d65ea4b7e1857b84985444653, C2 dtapi.cc / x1zsp.cc / cfmlapi.cc.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6adc4bf15a22ac805bd9e973

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6adc4be404ef5db552dd522e/reports/a209634e-16f2-462c-ab8e-3d1437a97645/overview

Verdict:

Clean

File Type:

zip

Link:

https://opentip.kaspersky.com/285ecbdb10b2ae2c71f82dbbd99aa73afcbb33333208929b8b751e95a480b62a/results?tab=lookup

Score:

26%

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.