MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33eafa96ff4f48b3d5a1f0b49358b6886c7080c6bd3c8b1f60c72a9000779518. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	33eafa96ff4f48b3d5a1f0b49358b6886c7080c6bd3c8b1f60c72a9000779518
SHA3-384 hash:	4ec243a2addee35080d68bf801b69e2b2557291f3d01743ebcd695fa904af7c1f3b2e5c1fb0b2241447ce5c8deaa5540
SHA1 hash:	6f57a55edb463ccdc71cd7457899ab941cd7ed0f
MD5 hash:	9a7c49b5626d492d78c3f4006e4626fb
humanhash:	zebra-sierra-freddie-uniform
File name:	Voltrix.exe
Download:	download sample
File size:	15'346'176 bytes
First seen:	2026-05-04 20:31:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ab5ea0ff9862d9b1e42f817f4aaf715f
ssdeep	196608:+Fy9/u9URCiF+saB9foz9G+/dK9/FCSPEHLYsV2pjeCgZ2rvDx2H5Nx:+AG889foTk7FgGGl
TLSH	T1B6F623FAB5C4B2E4C8C34580A29B57CF71F1A15946A9AC2C37CB3D02A931FA74649D73
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	c4b2aab292aad0cc
Reporter	burger
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

137

Origin country :

DE

Vendor Threat Intelligence

ACCE VMProtect_Packer_PE

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f8966e30-6078-49f4-9ac7-dcbf3d875914/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

Voltrix.exe

Verdict:

No threats detected

Analysis date:

2026-05-04 20:31:17 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/276f5b9a-46a9-4e38-87bd-eab221d5065b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/64508/

CyberFortress

Gathering data

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

barys packed

Link:

https://www.filescan.io/uploads/69f902297d31ad7bba4e3e1a/reports/ff705958-430d-4a87-954b-c91cccf19baa/overview

Hybrid Analysis Barys.Generic

Verdict:

Malicious

Labled as:

Barys.Generic

Link:

https://www.hybrid-analysis.com/sample/33eafa96ff4f48b3d5a1f0b49358b6886c7080c6bd3c8b1f60c72a9000779518

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x64

Link:

https://opentip.kaspersky.com/33eafa96ff4f48b3d5a1f0b49358b6886c7080c6bd3c8b1f60c72a9000779518/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/c7204b83-ba68-46cf-aae6-f93897dece6c

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

57 / 100

Link:

https://www.joesandbox.com/analysis/1908355

Signature

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Tries to detect debuggers (CloseHandle check)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/33eafa96ff4f48b3d5a1f0b49358b6886c7080c6bd3c8b1f60c72a9000779518

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/9a7c49b5626d492d78c3f4006e4626fb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/33eafa96ff4f48b3d5a1f0b49358b6886c7080c6bd3c8b1f60c72a9000779518/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/33eafa96ff4f48b3d5a1f0b49358b6886c7080c6bd3c8b1f60c72a9000779518

ReversingLabs TitaniumCloud Win64.Trojan.Barys

Threat name:

Win64.Trojan.Barys

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-02 22:13:15 UTC

File Type:

PE+ (Exe)

Extracted files:

6

AV detection:

14 of 36 (38.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gpvpvfx7j5elhvnb6c2jgwfwrbwhbaggxu6iwh3ay4vjaadxsuma._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

n/a

Link:

https://tria.ge/reports/260504-za16fact3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of NtSetInformationThreadHideFromDebugger

UnpacMe

Unpacked files

SH256 hash:

33eafa96ff4f48b3d5a1f0b49358b6886c7080c6bd3c8b1f60c72a9000779518

MD5 hash:

9a7c49b5626d492d78c3f4006e4626fb

SHA1 hash:

6f57a55edb463ccdc71cd7457899ab941cd7ed0f

Link:

https://www.unpac.me/results/b098ad08-5a86-4562-b3d9-f2b977a51d5c/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/64508/