🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33d60d42472a83d0d2cf4ee6640c615313c29b18ce1e8ab06e41f4bba558a34b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33d60d42472a83d0d2cf4ee6640c615313c29b18ce1e8ab06e41f4bba558a34b
SHA3-384 hash: 32e783ed3ef87d006970de760be6c98cefebf2e4ed59471411ce06715c30bfa43f4d9bf4cf861d517fa06573d31d0d0f
SHA1 hash: e331e61d3e33a9d8f4b3b2555236c4b78c2d61eb
MD5 hash: 990a6399346ff895e97a1f76e2ac5b88
humanhash: mountain-violet-red-lake
File name:estrosa.it.zip
Download: download sample
File size:25'525 bytes
First seen:2026-10-19 17:26:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:ZrHStB1se1pUekuueLZkKRV8UVtYMECerW:ZrHSvb1pDSeLZz8itYR3rW
TLSH T117B2E10780695B41D1AB717B68BFFA5CECE169AE2E04C629371E42A8D5ACC0C4CB8163
Magika zip
Reporter vxunderground
Tags:Coruna iOS zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
US US
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:group.html
File size:1'610 bytes
SHA256 hash: 2af55f5c00efad5e4d7547ca5153285db8a5d9e885d09d11fe85243faf8a11cf
MD5 hash: a41f5fb67c23493f8c259b61aaf2fe15
MIME type:text/html
File name:a8c3f01e6b47d295.js
File size:810 bytes
SHA256 hash: 19380347b2cb20a40469a6de4ebbf6fcfddff551e9f5d5ecd657f2957d82042a
MD5 hash: 33b6bb3a059070be1764659fde03f121
MIME type:text/plain
File name:49554fde7424c31c.js
File size:47'601 bytes
SHA256 hash: e9b106745a31d7ad4095dd87cf8f915cf600f929b6930b9ff3534826c649f803
MD5 hash: d7ecb60a44d27510432f5450095ad08a
MIME type:text/plain
File name:b8def7dab9dd9ad8.js.js
File size:8'283 bytes
SHA256 hash: d86a69137cda7c4e6caab58ccf66eb59a6f68282b2e10fcd186a7b8c5af3b710
MD5 hash: 9d9cc3de99aeb894846dbc004627b11b
MIME type:text/x-c
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0ac58e0b-2afe-4479-b392-2363669b6698/
Detection(s):
SecuriteInfo.com.GT.JS.Acsogenixx.6463.197567C4.15413141.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Script.SNH-gen.12722816.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad64e84afb06e650cd7dc9b
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
repaired
Link:
https://www.filescan.io/uploads/6ad652ba289d6ca96ae7a33e/reports/67e12471-9eea-44b0-8007-c043f881bcb8/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/33d60d42472a83d0d2cf4ee6640c615313c29b18ce1e8ab06e41f4bba558a34b
Score:
1%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/33d60d42472a83d0d2cf4ee6640c615313c29b18ce1e8ab06e41f4bba558a34b
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Zip Archive
Link:
https://app.malva.re/file/990a6399346ff895e97a1f76e2ac5b88
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/33d60d42472a83d0d2cf4ee6640c615313c29b18ce1e8ab06e41f4bba558a34b/
Threat name:
Script-JS.Trojan.Acsogenixx
Create hunting rule
Status:
Malicious
First seen:
2026-10-19 17:26:24 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
7 of 36 (19.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gpla2qshfkb5buwpj3tgiddbkmj4fgyyzypivmdoih2lxjkyunfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/33d60d42472a83d0d2cf4ee6640c615313c29b18ce1e8ab06e41f4bba558a34b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:MULTI_Malware_RemcosRAT_ForgeAuto_4785f0c3
Create hunting rule
Author:Marjoriefort
Description:Detects RemcosRAT (inconnu, etat binaire)
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via drive-by

Comments