🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a9d70d79cf080d7037f624722d40c4f39374f2a4459d3331ed608c293b0176e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a9d70d79cf080d7037f624722d40c4f39374f2a4459d3331ed608c293b0176e
SHA3-384 hash: 85c344cae80d33006fa9c96a613188e048d49714fc454cb14b6fe51856d8932e82aee86465963c4551cdf10b8876cc9f
SHA1 hash: 7ea22aabd87a55b3b8aca0a815fa8d49c7ac414d
MD5 hash: 536dfb53d4223cb425b53608d3dc78e1
humanhash: comet-vermont-music-hamper
File name:mbupload-wqe_lfhw.bin
Download: download sample
File size:11'349'313 bytes
First seen:2026-10-16 04:31:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:PXEpMX+nbohNcYmwDHyymKz5TFlVTWg4+r1kJuCwyJ542MKPdVgM5psa:PX3X+UhKwDsaTFlZ3zxkJuH2MKPdVgMv
TLSH T144B633DCEAD489CDE5C6343A67E449D295D40F3AA791BAD6E00123E104BF1EA1DE10BF
TrID 66.6% (.XPI) Mozilla Firefox browser extension (8000/1/1)
33.3% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter wristhulk
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
US US
File Archive Information

This file archive contains 37 file(s), sorted by their relevance:

File name:bot_actions.cpython-311.pyc
File size:34'443 bytes
SHA256 hash: 7b73b3dcd6e521302e2df2308af2eb099a8e76df2d43197aedd233b28880a9d3
MD5 hash: be7aa9da4bcf5c17e1d29982e86b006c
MIME type:application/octet-stream
File name:detect.cpython-311.pyc
File size:7'409 bytes
SHA256 hash: e6ffd9ec3e52f8689d7484554aa6c8259290bd573595c75564e59f562204827c
MD5 hash: 4b600800863f265ea9f5c00ebb6f1762
MIME type:application/octet-stream
File name:loader.cpython-311.pyc
File size:10'373 bytes
SHA256 hash: be06aa76e27157cee5290b0ab6c96123e68712b148a4c78aa60114c23fe7a5b9
MD5 hash: 2cabf658146037ea94dcfdec97203cc4
MIME type:application/octet-stream
File name:gateway.cpython-311.pyc
File size:7'021 bytes
SHA256 hash: f047e6c5886fb26aff94ee04295f7fc642d02d6616a42b701fc94f0cf69ae9ee
MD5 hash: 12d83b13044cf88947090144d0b2e45d
MIME type:application/octet-stream
File name:crypto.cpython-311.pyc
File size:8'657 bytes
SHA256 hash: 45b54d2512b6ae97b4d0ad6e674ccdbc8fe092ee2cdef3891b51bf03dcc52278
MD5 hash: 421d29ed53cc385c50ca71b098650c21
MIME type:application/octet-stream
File name:vault.cpython-311.pyc
File size:8'607 bytes
SHA256 hash: a31c95995167a9ddfa484ec6f6c3a927a6765772aa57927348fb67a398af3668
MD5 hash: 7fd59aadb0a690dc0cdfc4c2c852a418
MIME type:application/octet-stream
File name:run.bat
File size:625 bytes
SHA256 hash: c6279836073e721979333bb2b159c14e3246ff96a7047b109a4ddecaa3074ac8
MD5 hash: 068dde961ba03dd4bc127af9e9c7392f
MIME type:text/x-msdos-batch
File name:about.cpython-311.pyc
File size:3'918 bytes
SHA256 hash: 8ba69bdd64896fa863220b74b7e33dae694e4bd251f3aa34edc9647874cbe434
MD5 hash: 4bbcd6b4945b124ebd7eb6b62753657a
MIME type:application/octet-stream
File name:network.cpython-311.pyc
File size:7'059 bytes
SHA256 hash: 38e00e8b7459a8aa9ab0adc1aa6e37aba17ecdf64883711c7fedd9abbcfbf0b2
MD5 hash: 92f0d581d618d2a570bd31737805b559
MIME type:application/octet-stream
File name:agent.cpython-311.pyc
File size:9'862 bytes
SHA256 hash: f42e0c5f33a97957df82dd115c7d599441d5f268e65e90691b6a7c3eadf1331f
MD5 hash: a4fcd64849274ceb2f5b5e41c4cba75b
MIME type:application/octet-stream
File name:ui.cpython-311.pyc
File size:14'369 bytes
SHA256 hash: ccd0d12a955ddbe2ed180fb6598194f822dd7ff70a2517fdde03bda406326966
MD5 hash: 71e1385371ee1cddcff98486545fa87d
MIME type:application/octet-stream
File name:install.cpython-311.pyc
File size:3'613 bytes
SHA256 hash: 270fa33eafbf61b1b60af0076b35986b2012179737d09ec3a53080907ff1ce6d
MD5 hash: 1f54fb4d31959ed03be71a290359b639
MIME type:application/octet-stream
File name:system.cpython-311.pyc
File size:7'348 bytes
SHA256 hash: e0fd592014c4dc35a485671da018b11d16f7ea2dbfda44cde977efb8d37a0d62
MD5 hash: 5318f34a8a4b3835802e5e28d0d1a2a8
MIME type:application/octet-stream
File name:config.cpython-311.pyc
File size:3'706 bytes
SHA256 hash: d25e012be6443613032c95925db274df74d48e269867bfcdbeeb5f1cfa421f4e
MD5 hash: 61b1850b37f3e584dfb525cd21bc5a15
MIME type:application/octet-stream
File name:settings.cpython-311.pyc
File size:3'979 bytes
SHA256 hash: 5fa319c93f1dfe89e3598ab54f4cb9dce4ca5b22232eb324fc46cbc8c724947f
MD5 hash: d16f38f1337f04da8632b5094e97c562
MIME type:application/octet-stream
File name:__init__.cpython-311.pyc
File size:10'241 bytes
SHA256 hash: 11d226fe631887f6f8af36062fa11dbc21bac8f5880cf47eeeb4970bb595a29e
MD5 hash: 14ba56aaecad1ee2ac8f11e67262ee64
MIME type:application/octet-stream
File name:main.cpython-311.pyc
File size:6'159 bytes
SHA256 hash: c128d6e2069b4020f289caaaa224f0d04d8606f9e3c14f57a7c821341f9ab10a
MD5 hash: 8c2a260be814f90be6fb4fb3d2708401
MIME type:application/octet-stream
File name:requirements.txt
File size:101 bytes
SHA256 hash: e266a094c40cd75a3ad55d7abb367528ab0892ff628eceecbb0862f43c09ca67
MD5 hash: d84d11ac2ba772756be6101a8adc5454
MIME type:text/plain
File name:gateway.py
File size:3'821 bytes
SHA256 hash: db1ea76f4cd3355451c49dcaebd0db383939727947e52ababf7f3503801cc9cd
MD5 hash: fe26061c5442c5c914080acf35de223c
MIME type:text/x-python
File name:install.py
File size:1'932 bytes
SHA256 hash: 355d49469c4cfb0b82cd3e6843b473828bca5b2243eed1fa6cb83fec13f3b39a
MD5 hash: db3a060effd28af850cb9cd0de662135
MIME type:text/x-python
File name:ui.py
File size:7'524 bytes
SHA256 hash: 55f87e415d007d7304a04d952601a1fa8cc616fe25e669deecb850fe26d91363
MD5 hash: 4d8397aff2640b401d842d7b2aa4e9df
MIME type:text/x-python
File name:registry.py
File size:3'330 bytes
SHA256 hash: 97e629103bf8037b1194828c546dfc680aec1f358d5284a19707b6caecab16cf
MD5 hash: 8f006b345278a56d1ff313e89fcb9fe4
MIME type:text/x-python
File name:__init__.py
File size:5'771 bytes
SHA256 hash: 5c3e749b1bb46516c4e77586f099c653ac9877171661292a6e9a6f114295aa65
MD5 hash: 5c100d13fa35dc3a20a68c583ab4b628
MIME type:text/x-python
File name:main.py
File size:3'593 bytes
SHA256 hash: 08ac6e06d769a50555169f6d4d11ecf7307f86e10fc8c494c819f5eb72f250e6
MD5 hash: 54aacfbc65310c60fe0ac11b42ae9f69
MIME type:text/x-python
File name:browser.py
File size:3'497 bytes
SHA256 hash: 3ac0a7f585edd3b8ecc4ae9d7a811d440a56ea0b3ef513001f6ad0379615080c
MD5 hash: 033156ad56750dec5fbee29a09122935
MIME type:text/x-python
File name:settings.py
File size:2'541 bytes
SHA256 hash: 2c400c3642545062e75f3bdbcd92e8fbeece4a625274a78f05f79e786c38bb42
MD5 hash: 5ec89f8cd4101daf0a3fd1e98243dcc4
MIME type:text/x-python
File name:README.md
File size:420 bytes
SHA256 hash: 771acabb16de8f2299065b0fff17b3fa031bf27a0dba0c8fb8b60705d7ad2962
MD5 hash: e600432e1ed3488fe92d948d9cdc4093
MIME type:text/plain
File name:about.py
File size:2'862 bytes
SHA256 hash: 0a404de94f802cb5836def9556d55febfcf527f075a66f90c03fe8641ca16aa5
MD5 hash: cc1ea69fdfe53877d3dd411aa1e0cb9f
MIME type:text/x-python
File name:system.py
File size:3'816 bytes
SHA256 hash: 29de5803facb139a354b570406269b6922e793de151dc35851703eb13d48de4b
MD5 hash: c0f84a1b287c0b722ec2d8652cda4e90
MIME type:text/x-python
File name:bot_actions.py
File size:22'014 bytes
SHA256 hash: 273c4c2342f24b5c650cfa8d58413d8f3dc0a99241c3f9b54ad7038142dff672
MD5 hash: 9b2c726f9a0683305093657b1c95cd36
MIME type:text/x-python
File name:decrypt.py
File size:2'859 bytes
SHA256 hash: 87cc6392f6bb5c3abc57e4759ac236eed7d19bd763836aad9048b1ae2cca96a3
MD5 hash: e18bfb9402db7a7eb01882f1a4aa74cc
MIME type:text/x-python
File name:pack.zip
File size:11'249'026 bytes
SHA256 hash: 663bc9b60fedd186766837c3b16c72e6875308818ef8741ebaa177f263fed240
MD5 hash: faebf57f03eeea92348438ba3c0af35c
MIME type:application/zip
File name:vault.py
File size:4'329 bytes
SHA256 hash: c5681b8c5d9902692c4d42ef9ad362346126da184d5bcc5b37bd52163f78d1f1
MD5 hash: d154cc0704ea77e16793b58188af6f85
MIME type:text/x-python
File name:extractor.py
File size:3'073 bytes
SHA256 hash: 5de82c3e32e1c589f2746883bb2f929b176c9d2f131880a63cd057a527598e8a
MD5 hash: e9f8a4d64b2ac386a7cb5e778e63123a
MIME type:text/x-python
File name:run.sh
File size:612 bytes
SHA256 hash: 994fe76a7058bc61f0563f63735a6ad145c3431db38a88f29cd330a0205279a9
MD5 hash: 63faacb8be35c47856ee340f0b9eb168
MIME type:text/x-shellscript
File name:agent.py
File size:5'475 bytes
SHA256 hash: 068f72d40862c0ad360c61cefe629a456be0d9d25b440f478b60bff5bad2357a
MD5 hash: 6d85a6962fcee72921ba38e5f284bdc8
MIME type:text/x-python
File name:config.py
File size:2'946 bytes
SHA256 hash: f6a6ca3841ff767b195e7cd3aa8dcad4b075b61162c23f35c827ac3b7013c173
MD5 hash: cafe485773779d2cff1990be7c7bc528
MIME type:text/x-python
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c8406371-f18b-441c-8607-1e82514a943b/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad1bb646f551121ba1683b6
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2a9d70d79cf080d7037f624722d40c4f39374f2a4459d3331ed608c293b0176e
Verdict:
Unknown
File Type:
zip
First seen:
2026-10-16T04:08:00Z UTC
Last seen:
2026-10-18T00:13:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2a9d70d79cf080d7037f624722d40c4f39374f2a4459d3331ed608c293b0176e/results?tab=lookup
Score:
65%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/2a9d70d79cf080d7037f624722d40c4f39374f2a4459d3331ed608c293b0176e
Verdict:
Malware
YARA:
4 match(es)
Tags:
DeObfuscated Executable PDB Path PE (Portable Executable) PE File Layout PowerShell T1027 T1059.001 T1059.005 Zip Archive
Link:
https://app.malva.re/file/536dfb53d4223cb425b53608d3dc78e1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a9d70d79cf080d7037f624722d40c4f39374f2a4459d3331ed608c293b0176e/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-05 06:35:58 UTC
File Type:
Binary (Archive)
Extracted files:
1449
AV detection:
3 of 38 (7.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fkoxbv446canoa37mjdsfvamj44totzkirm5gmy62yemfe5qc5xa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/261016-f7wgnshx5z/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/2a9d70d79cf080d7037f624722d40c4f39374f2a4459d3331ed608c293b0176e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 2a9d70d79cf080d7037f624722d40c4f39374f2a4459d3331ed608c293b0176e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3950802/
  
Delivery method
Distributed via web download

Comments