🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35f031359ee5f45d7a6385194fb282e1834f955b5b1b2ecd9b5c8dcbeb68c81d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35f031359ee5f45d7a6385194fb282e1834f955b5b1b2ecd9b5c8dcbeb68c81d
SHA3-384 hash: 53294c95bd9a5c7b2f028b163117a53712c47cff4a38d68fd6ed6c89673e7fae141af0872cce1fb53fba0c211c6156ac
SHA1 hash: ce61e256e1ea7d97ecebb32f1a7f6ef9c2198868
MD5 hash: 3eef222775abe3de125709b6c260e54e
humanhash: beer-bulldog-october-sweet
File name:nox-fleet-spotify.png
Download: download sample
File size:9'696'867 bytes
First seen:2026-09-23 12:56:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:oagt2vTjqDyLgbbUcmLeK5ewpiOQCULvvEX7hgQ9vmUtGHR43glCS6s2CzrRjof:4t2vTjqeuzmV5FpiOoLvvs2UvNgHR43v
TLSH T19DA63341D275308520306E2553025CE06F4BBEDDD8F2ECE39AF95A6B72C84D95ECAEE1
TrID 60.0% (.USDZ) Universal Scene Description Zipped AR format (generic) (6000/1/1)
40.0% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter GhostTypes

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
FR FR
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:rename.exe
File size:17'232'384 bytes
SHA256 hash: d74ca37af3e73bbaf6b88201aba801a3aa4dbbb51221e8bf89609293a3de14c7
MD5 hash: 99917edcac7e4cea1b7e7d090e0cc10f
MIME type:application/x-dosexec
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/8f6d189f-6dd0-4676-949f-aaa51f36ac4d/
Detection(s):
SecuriteInfo.com.Generic.Dacic.23874.BD21D1DF.17716152.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
File Type:
PE File
Link:
https://app.docguard.net/35f031359ee5f45d7a6385194fb282e1834f955b5b1b2ecd9b5c8dcbeb68c81d/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/35f031359ee5f45d7a6385194fb282e1834f955b5b1b2ecd9b5c8dcbeb68c81d
Verdict:
Malicious
File Type:
zip
First seen:
2026-09-23T12:11:00Z UTC
Last seen:
2026-09-23T13:39:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/35f031359ee5f45d7a6385194fb282e1834f955b5b1b2ecd9b5c8dcbeb68c81d/results?tab=lookup
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/35f031359ee5f45d7a6385194fb282e1834f955b5b1b2ecd9b5c8dcbeb68c81d
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/3eef222775abe3de125709b6c260e54e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35f031359ee5f45d7a6385194fb282e1834f955b5b1b2ecd9b5c8dcbeb68c81d/
Threat name:
Win64.Trojan.PSWStealer
Create hunting rule
Status:
Malicious
First seen:
2026-09-23 12:57:29 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
15 of 23 (65.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gxydcnm64x2f26tdqumu7muc4gbu7fk3lmns5tm3lsg4x23izaoq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/260923-s8vmzsxt9m/
Behaviour
Checks BIOS information in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35f031359ee5f45d7a6385194fb282e1834f955b5b1b2ecd9b5c8dcbeb68c81d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Promethium_MaliciousPacker_20211202
Create hunting rule
Description:Detects Promethium Group MaliciousPacker
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:skip20_sqllang_hook
Create hunting rule
Author:Mathieu Tartare <mathieu.tartare@eset.com>
Description:YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:https://www.welivesecurity.com/
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments