🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 351395a3055b183263aa2e4cc2245fdc0ffd249b0011ac65bdc8d471d1b5b4c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 351395a3055b183263aa2e4cc2245fdc0ffd249b0011ac65bdc8d471d1b5b4c5
SHA3-384 hash: ecf932a87aac8db9facfa5d4eb23bb5316b97862eb7bfe33a17c332dfa9504f39c6dda7043d0755dd4093f01213a2aee
SHA1 hash: b10216ece0845da0b0a05482281295c1d3590a19
MD5 hash: 9ec67aab419801a2f181de5d8f6e6f28
humanhash: indigo-solar-muppet-sierra
File name:payload.zip
Download: download sample
File size:55'995 bytes
First seen:2026-10-20 08:09:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:4GsY+oJUWCVhRKPhKsY/5iFtxsLknErPV3tLZRXJWH2Hh4t3cR0L70SBB4HNJPWt:4GsQUWCX4PI5awt3VxmjiGxBGttWiI6O
TLSH T1BE43022CC69CD950CAF536B89B423C970199188B889A51CB0521BAC9DD81FCBD6DF5DC
Magika zip
Reporter smica83
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
HU HU
File Archive Information

This file archive contains 11 file(s), sorted by their relevance:

File name:34dd3d3d.js
File size:3'958 bytes
SHA256 hash: 4f50c233c330a64081048b54f2f81b176dd289249bc29b16e2142a816c567c7e
MD5 hash: e089cd34d900790d6a5e53a3aa65b6ed
MIME type:text/plain
File name:854a4a00.js
File size:8'164 bytes
SHA256 hash: 50c84c5aec57254da4abba501ad3e3038af24b4b73f0c828247ac8bc7d1f9c46
MD5 hash: b628b6500863653ee78424f5a6700b12
MIME type:text/plain
File name:desfazer.bat
File size:3'216 bytes
SHA256 hash: e67d5ce98f64c57c014d5cb17ee93c4a495d216676dff0d38a19e27e4727de5c
MD5 hash: 800b9921867130a0620b2def04dd6261
MIME type:text/plain
File name:45791b1c.js
File size:9'368 bytes
SHA256 hash: e5fb0002c187cb53c5df13c7ce736ec0d7393d6a8d085e027a6a08efc5e49442
MD5 hash: b38a90cb01c3f86b58cf706bf49cf6ef
MIME type:text/x-c
File name:run.dat
File size:24'464 bytes
SHA256 hash: bcc6d6fd609022c22814086b39947d36e3266565c62861f0277f5bb5187f9305
MD5 hash: 32c51d3af6a9e181f282f5ab981f99f9
MIME type:text/plain
File name:run.bat
File size:3'201 bytes
SHA256 hash: 5265cb110b3bb423dd7eddd79685400e02ef36a1ac0ce3fec345ed64f59548d6
MD5 hash: cc75304fb0d7043264be358aec6f8002
MIME type:text/plain
File name:desfazer.dat
File size:37'132 bytes
SHA256 hash: 7e6669653ee2c1be8b03ab7a45e276ef59b01cfdbf7d76fe4916b51ee60e7fad
MD5 hash: 55636a947f0a3ca183820d924100fdd7
MIME type:text/plain
File name:manifest.json
File size:1'010 bytes
SHA256 hash: a6d1f3e4ba8a5d2d4d9e121310d1191a1f6e566dc5d5e2d96af7ba4a472a4de5
MD5 hash: 963aeb926be77500f252755e573fcbdf
MIME type:application/json
File name:29228d1c.js
File size:7'848 bytes
SHA256 hash: f96ca394f655ae883136eb7df374b830b5468e3d7943872886ab6893f93f037f
MD5 hash: a214c938489cfabeb2ba83c3397a772e
MIME type:text/plain
File name:a7b18fe1.js
File size:2'756 bytes
SHA256 hash: 92bde0cf54cd825563de5cf2516b1f4b24e55a68bb557a86b04c4b409e70ed10
MD5 hash: 2c86b065a3d3773a39564d1b13841489
MIME type:text/plain
File name:9307a0c6.js
File size:18'174 bytes
SHA256 hash: 724027b1a5c1d18bdbe6f3ed31981c3e15465806b49a013056e55155bc0902ba
MD5 hash: b442f0f335e284c7fa002c380d70cb3e
MIME type:text/plain
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c42e412a-8401-4bff-8298-52d7aa5a88c4/
Detection(s):
SecuriteInfo.com.Exploit.Gen-1.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad721ed5a22ac805bd8102c
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/351395a3055b183263aa2e4cc2245fdc0ffd249b0011ac65bdc8d471d1b5b4c5
Verdict:
Malicious
File Type:
zip
First seen:
2026-10-20T00:17:00Z UTC
Last seen:
2026-10-20T18:03:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/351395a3055b183263aa2e4cc2245fdc0ffd249b0011ac65bdc8d471d1b5b4c5/results?tab=lookup
Score:
56%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/351395a3055b183263aa2e4cc2245fdc0ffd249b0011ac65bdc8d471d1b5b4c5
Verdict:
Malware
YARA:
3 match(es)
Tags:
DeObfuscated PowerShell T1027 T1059.001 T1105 Zip Archive
Link:
https://app.malva.re/file/9ec67aab419801a2f181de5d8f6e6f28
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/351395a3055b183263aa2e4cc2245fdc0ffd249b0011ac65bdc8d471d1b5b4c5/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gujzliyflmmdey5kfzgmejc73qh72je3aai2yzn5zdkhdunvwtcq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/261020-kclffaxvh1/
Behaviour
Command and Scripting Interpreter: JavaScript
Malware Config
Dropper Extraction:
https://nodejs.org/dist/v22.20.0/node-v22.20.0-win-x64.zip
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/351395a3055b183263aa2e4cc2245fdc0ffd249b0011ac65bdc8d471d1b5b4c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Certutil_Decode_OR_Download
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Certutil Decode
Reference:Internal Research
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:MULTI_Malware_Unknown_ForgeAuto_2d47e303
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_0507f067_Script
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat script)
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_990bfd2e
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments