MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38a651911849f0fc68b5c29d53e1724919a5228ffc24091d2836d16483c55f9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 10 File information Comments

SHA256 hash:	38a651911849f0fc68b5c29d53e1724919a5228ffc24091d2836d16483c55f9b
SHA3-384 hash:	e244c43f872aee066425037ac920ab684db3231b93671806a95722577fc086d5637d723edc01ea118e16d0f5def6503b
SHA1 hash:	dee69a7bd8d33fdc122726e748416105209ef7ef
MD5 hash:	527decd7a041cbb8d39d311cad7528b1
humanhash:	alaska-asparagus-texas-cold
File name:	vyEaw.rpm
Download:	download sample
File size:	11'204'526 bytes
First seen:	2025-02-16 12:36:06 UTC
Last seen:	2025-05-04 12:19:25 UTC
File type:	zip
MIME type:	application/zip
ssdeep	196608:bl+SLohWneoiMZXvBsLBE+KxRH0cxAJYwJtov5/4j1UaKPa:bRLy+ZZGnMvI7Av5/4JnWa
TLSH	T119B688CAEC53D697EE29129AD89DC3AEAC5C4E6535F1D441FB30C0FCC222E45925AF84
Magika	zip
Reporter	aachum
Tags:	file-pumped HIjackLoader zip

iamaachum

https://animalear.store/?data=jeYQ3vTqHDrhp6f&pub_id=12&site_id=22 =>https://www.mediafire.com/file/yrke00q1hv4zo9o/@#%E2%9D%A2%C7%B4%F0%9D%95%96%F0%9D%94%B1-%F0%9D%95%8A%F0%9D%95%96%F0%9D%95%A5%F0%9D%93%A4%F0%9D%95%A1-6790__%E2%84%99%C7%8E$$%F0%9D%95%A8%F0%9D%9F%98%C9%BE%F0%9D%94%BB@!!.zip/file => LummaStealer pumped executable =>https://qu.ax/vyEaw.rpm

C2: 62.60.234.80

Intelligence

File Origin

# of uploads :

# of downloads :

551

Origin country :

File Archive Information

This file archive contains 56 file(s), sorted by their relevance:

File name:	UXCore.dll
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	700'163'098 bytes
SHA256 hash:	611890ac4d16437fece2cd83e324e5e711a5ccb14022b323ff8d11fa5796a2f6
MD5 hash:	47c23db969bba42d4a7c3c8ac6c56251
De-pumped file size:	830'464 bytes (Vs. original size of 700'163'098 bytes)
De-pumped SHA256 hash:	ce285bc3552f81c29f8adb552d1ff5b192bd78d6e292e63e5c622296c35349a4
De-pumped MD5 hash:	9bb05a1e784ddec8e61151ca6409ff25
MIME type:	application/x-dosexec

File name:	vcldb290.bpl
File size:	731'112 bytes
SHA256 hash:	32cd2f4bebb1b78c12b097a7ad1284a8efa5d7b58034b8027ddca97d5540604a
MD5 hash:	85fbd9cb75a82a01dfd94c5e70247c65
MIME type:	application/x-dosexec

File name:	TPASSWORDDIALOG
File size:	964 bytes
SHA256 hash:	4e5728d0faff235d9b94df07cfb963dfa005d1481835331448b88fc3873eb6a5
MD5 hash:	72bff64571f7bc5f84fe6f90017730d5
MIME type:	application/octet-stream

File name:	stdvcl40.tlb
File size:	3'324 bytes
SHA256 hash:	47195bcab1813d10dda73c882375a847fc466d3114136617574b8a22dc256cd8
MD5 hash:	594f247e69e368c918499317a341b874
MIME type:	application/octet-stream

File name:	string.txt
File size:	1'098 bytes
SHA256 hash:	dc9e9399dd00c0611678e97dad20df479e8cc98c76290e0c507a8926c43c9d87
MD5 hash:	c762d4aca4638e1aecaa71043d856e03
MIME type:	application/octet-stream

File name:	vclie290.bpl
File size:	1'546'216 bytes
SHA256 hash:	10ef9bfa6fd4df9280a9eebe8412e91aef489b056dae940d7a01f7654fb9332d
MD5 hash:	7517c4834aa2c23ac9ab16ea013642d9
MIME type:	application/x-dosexec

File name:	Dashboard.exe
File size:	145'264 bytes
SHA256 hash:	8cc871ee8760a4658189528b4a5d8afe9824f6a13faaf1fe7eb56f2a3ad2d04e
MD5 hash:	704925ecfdb24ef81190b82de0e5453c
MIME type:	application/x-dosexec

File name:	msvcr80.dll
File size:	626'688 bytes
SHA256 hash:	cb8928ff2faf2921b1eddc267dce1bb64e6fee4d15b68cd32588e0f3be116b03
MD5 hash:	43143abb001d4211fab627c136124a44
MIME type:	application/x-dosexec

File name:	PACKAGEINFO
File size:	208 bytes
SHA256 hash:	5ea27066947da328f7e183147c50817f02563ea4c9bb5c5bd314e65130e7f555
MD5 hash:	0ea5c0c3dd507c53a88f80dde8b9ab5b
MIME type:	application/octet-stream

File name:	BORLAND_SIG
File size:	178 bytes
SHA256 hash:	891905b0a48747fc22a75ded384509476d5d6ff05d6180173fffc4bfd1bcef3c
MD5 hash:	238d5b04f88d0411d4f7d1454a7042fb
MIME type:	application/octet-stream

File name:	stdvcl40.fr
File size:	205'800 bytes
SHA256 hash:	aea176645bc564b5f60f86adcd427de4fceb5d17adcb644b006662fe7b5103d7
MD5 hash:	0fe2b2e6af0809d88edf6e2e23dc31b3
MIME type:	application/x-dosexec

File name:	stdvcl40.ja
File size:	195'560 bytes
SHA256 hash:	c332ccd0e179827ec2e5169d862c1ed044098ca9ce8eae968339f4c16c9bed9e
MD5 hash:	28c260e1f9cbfa884fbe8f34d6a0d882
MIME type:	application/x-dosexec

File name:	TLOGINDIALOG
File size:	1'160 bytes
SHA256 hash:	b75e659eda12a0a369413b19b813f07291a87e07cca6b6da2f72478882237a49
MD5 hash:	bca6baf2a1a666dedd94e0b07f0ed146
MIME type:	application/octet-stream

File name:	vclimg290.bpl
File size:	543'720 bytes
SHA256 hash:	1037c31c81f9917726e2f00e406aca769b97e19245dd095e72804535d5a96149
MD5 hash:	b61e66c7eeabd7ad7941107f8d234692
MIME type:	application/x-dosexec

File name:	stdvcl40.de
File size:	206'312 bytes
SHA256 hash:	2482298890ab3e4477fcb18759c7f5a55d0882499fcfedcecfe7b5b2489ad817
MD5 hash:	3a25955ec6ce6dd5cb2e0bedbb5db46d
MIME type:	application/x-dosexec

File name:	vclib290.bpl
File size:	116'712 bytes
SHA256 hash:	c5612c18acb8cd56394c77f05fb8891bc6fe8a25d2271e5c65464738b5f92689
MD5 hash:	eebd5a4714fce772b6ef31387403db4c
MIME type:	application/x-dosexec

File name:	vcl290.bpl
File size:	6'163'944 bytes
SHA256 hash:	1999d640078dd829765498142f33530a56f9b9d66871a981ee575333161d09fa
MD5 hash:	d5c9c62404c794a728243f00f42edaa1
MIME type:	application/x-dosexec

File name:	isostasy.mp4
File size:	41'825 bytes
SHA256 hash:	7c2dbb8c0a98a740c3db40814810f06ca4c388375d3d2f4116fc0376d81e6cc7
MD5 hash:	fa6e6a74d06d3e80e5a0511908e098ac
MIME type:	application/octet-stream

File name:	obedientiary.accdb
File size:	6'114'246 bytes
SHA256 hash:	95c0b28deba5f8b103deadeb8ce769b22e78b1ceea54db682e4372af0863f73e
MD5 hash:	c2eb4fbfb8d905492ac7e994b8fcfed6
MIME type:	application/octet-stream

File name:	DBN_APPLYUPDATES_20X
File size:	3'332 bytes
SHA256 hash:	a7aadcfc3cb0632bce0f92eb57de1471088e1b28761d36d3c31cf59f148854fc
MD5 hash:	eb15de699fe9c84fd00ea2357f48676a
MIME type:	image/png

File name:	DBN_CANCELUPDATES_20X
File size:	3'382 bytes
SHA256 hash:	769ff7fbc2586d76bc83fd740615700a06231dd5d7a58e84019d74186437ebb3
MD5 hash:	132dc0847cb6d284394bb55d27d571d6
MIME type:	image/png

File name:	DESCRIPTION
File size:	64 bytes
SHA256 hash:	85a83ae9489a1a50ae8c6891389cfa81c33612ad8ca2f6c8ccddd3c619eed5ff
MD5 hash:	1be9b80263b649f2d17aa192ebb94fa0
MIME type:	application/octet-stream

File name:	DBN_FIRST_20X
File size:	3'091 bytes
SHA256 hash:	8fa9f5c8fa7963a2486821542aec875093ba393d5e0a63380acdc0f413006fab
MD5 hash:	931480055b80505934265bbcb8479533
MIME type:	image/png

File name:	DBEDIT_20X
File size:	2'939 bytes
SHA256 hash:	0838008eb6620c4e56e17e1dfb23ab0e80b0d27d7574f15b4867fb73c7ea6d74
MD5 hash:	9061bd4b0d58768f5b9aa4330f52ab7d
MIME type:	image/png

File name:	DBMULTIDOT_20X
File size:	2'941 bytes
SHA256 hash:	5d0253f91fdb02989fadfe2a8661955b1cfb6625f9733d9d739b07ebe8b1f0db
MD5 hash:	8a4cac66fc5ac83c94cd7d7075398b5e
MIME type:	image/png

File name:	DBN_REFRESH
File size:	3'116 bytes
SHA256 hash:	d81da2a329e0fc69726048a42fc52868901dadb828b517a0486973d9f3998e3b
MD5 hash:	ec7af0c650b34e582a962bd60759d167
MIME type:	image/png

File name:	DBN_CANCEL
File size:	3'086 bytes
SHA256 hash:	6edd3584068ab82b5112e6f7d66e6826ad7fe4a2026421dfbb67143f48a3e258
MD5 hash:	933563ea8bad8538f0308013afab99fd
MIME type:	image/png

File name:	DBN_LAST_20X
File size:	3'072 bytes
SHA256 hash:	dc89ad6c43275d4f21f5d0424349a9a4b1a2a37c1fed8fbfbc8169ddfe03125b
MD5 hash:	fdc515522d173c79e2e26822a23ca6fc
MIME type:	image/png

File name:	DBN_INSERT
File size:	2'845 bytes
SHA256 hash:	96852fa6c8fe711c6a9562e12894644e78b62dfa2fba4dc6a459fdf920b974cd
MD5 hash:	ff9eaaeefcb04224c603dafe6bfc246c
MIME type:	image/png

File name:	DBN_INSERT_20X
File size:	2'885 bytes
SHA256 hash:	e85962518145d204a600e7867880f2959e6df222fe9115decfd94b76a8e8f535
MD5 hash:	85d857979694ee815496c6752f19c123
MIME type:	image/png

File name:	DBN_CANCELUPDATES
File size:	3'099 bytes
SHA256 hash:	f05520427af02f1562a9fa340384eaecfb5ea90f5bf47479bf50cc4838cf6be3
MD5 hash:	8b3e343a1307930996365c5a5f10a47d
MIME type:	image/png

File name:	DBMULTIDOT
File size:	2'872 bytes
SHA256 hash:	14617fb99a1a6898d6a54746b789180da7d55ae7a542176a699d7ea61e9a7659
MD5 hash:	01db3320a0cc5b93465ae04028506fce
MIME type:	image/png

File name:	DBN_APPLYUPDATES
File size:	3'070 bytes
SHA256 hash:	94649b935cae4a4c56e870ea5ce3179840ac2d58fce1e54925d3d3f14e0fc9d0
MD5 hash:	5f73a822e380fd4b0dc5e19dae1da49f
MIME type:	image/png

File name:	DBMULTIARROW_20X
File size:	3'132 bytes
SHA256 hash:	726f974f869b8b4a75b2157e2dca0d3744092778da2015ef7fc0797f2e9ac932
MD5 hash:	8cb311a1d7b0707df797c774138aca47
MIME type:	image/png

File name:	DBN_PRIOR_20X
File size:	3'075 bytes
SHA256 hash:	27225802b5d4a99e1128ba6d8c55ccf41b08efba0d792ad3bd52e94652299230
MD5 hash:	2de2a7088690a575eb60207cc422ec86
MIME type:	image/png

File name:	DBN_DELETE
File size:	2'823 bytes
SHA256 hash:	8598b9bb00d59e002ceeec2814a650e8e53b1356a377aa0d4c2571c9a45f6554
MD5 hash:	61a46e1aa7c1406e5baa90b6a81c3dec
MIME type:	image/png

File name:	DBN_FIRST
File size:	2'957 bytes
SHA256 hash:	e4ee6849549924cc2ead180a43749dd0121d21d1e50b2120d1cead33dc1beafe
MD5 hash:	5ae2e14ef4d50760554aa3f97d39641f
MIME type:	image/png

File name:	PLATFORMTARGETS
File size:	4 bytes
SHA256 hash:	11221c95aa48f7a54b99cf211c7d1d7b24e4135cabe53b36519e404e488e0c9c
MD5 hash:	ed73b5fa4811a511064845af456895ce
MIME type:	application/octet-stream

File name:	DBN_NEXT_20X
File size:	3'062 bytes
SHA256 hash:	e8330be5de4eb90aa4eabd204eb4f7f7809020da040c221a4ed3e655726f5bf7
MD5 hash:	a38b7d3d17d1490e8dc439445a2941f8
MIME type:	image/png

File name:	DBMULTIARROW
File size:	2'959 bytes
SHA256 hash:	35b4b29520b44004043975498cfd0a989bdae9eb05f25fd2a965513b3640e27d
MD5 hash:	8a9d6a33bf1f6c889cf37ed75301c806
MIME type:	image/png

File name:	DBN_EDIT
File size:	2'939 bytes
SHA256 hash:	d0c1e81b4b91c7013a4fb05b30402ccc998c836eb32494e290289d787a7af227
MD5 hash:	32e725e63d26fa3200b8a8786149c34c
MIME type:	image/png

File name:	DBINSERT
File size:	2'933 bytes
SHA256 hash:	352b602e0b7d7e29a82703da7645cb33fd64138aac91403e37101e48e7319c93
MD5 hash:	bbe2048d70d20e561da9659f5decd788
MIME type:	image/png

File name:	DBN_POST
File size:	3'051 bytes
SHA256 hash:	778d8de3bb590f485265c3eb10aab224cd4070bb3e3de9fdc8f576f94984823c
MD5 hash:	91b40fac1dfe9bc993874b52f12e0e2e
MIME type:	image/png

File name:	DBGARROW
File size:	2'875 bytes
SHA256 hash:	bd75087468560c5fc9f14a0efcaa4ff2e724798201b9c7d0823a80c95a3de319
MD5 hash:	63509f2499ed9a869227bfedd28f950e
MIME type:	image/png

File name:	DBN_DELETE_20X
File size:	2'857 bytes
SHA256 hash:	de75f577276ecf2296204541449c7c6785a328cc96708a30f5932b930bba5664
MD5 hash:	b03f992db458775b7d0ce2c2724cbf4b
MIME type:	image/png

File name:	DBN_PRIOR
File size:	2'947 bytes
SHA256 hash:	c5bc5c9e220d187bc9960ee08fadc407e87143dbcd36f589ad54812ad824e236
MD5 hash:	cb6871071f680ffa7d711c065c610d7d
MIME type:	image/png

File name:	DBGARROW_20X
File size:	2'977 bytes
SHA256 hash:	9627e46c5aa7b4094ba08c75e7bde907c1afbf4fa550b63ab764223cf727cba4
MD5 hash:	3fe8c1e380ebd909cdffc6507feed6ce
MIME type:	image/png

File name:	DBN_REFRESH_20X
File size:	3'397 bytes
SHA256 hash:	a7ab65c0313ef0b6fe9d9853d3566281a9c719cec9896ae18837eddc3a80f2d7
MD5 hash:	f652c77fb14d1ec495ab4b6ad9707166
MIME type:	image/png

File name:	DBN_POST_20X
File size:	3'205 bytes
SHA256 hash:	a296587838e58fdcbdef6388fcebe84f65e099e0845177e0fcf2e3aa82a1b9b4
MD5 hash:	e47fc609d8be2f73656048e58c3db609
MIME type:	image/png

File name:	DBN_CANCEL_20X
File size:	3'343 bytes
SHA256 hash:	abf6802db2d3335ddc7277dcb611c343ec43376ee5efafe9255ea37321f1324b
MD5 hash:	2b5cd86b456e6ac2a023a2d72dff6a6d
MIME type:	image/png

File name:	PACKAGEOPTIONS
File size:	96 bytes
SHA256 hash:	1eb5b51e002adbc57717c0f33a7959a14c7381fe5c42ba7e43d98d01e120b01e
MD5 hash:	a159e636edd1b941964f8368ddb0bf7a
MIME type:	application/octet-stream

File name:	DBN_EDIT_20X
File size:	3'028 bytes
SHA256 hash:	31f33d87435a2a216c883aeb0f919e52095a9889ce9a482d3064a88f744a7305
MD5 hash:	07a2a8c676d31e6a5728e73ca406fd77
MIME type:	image/png

File name:	DBINSERT_20X
File size:	3'035 bytes
SHA256 hash:	76e52db94056973c325bec0bb400fed16c9d9ee403e5d5fd71a159417e23eeaf
MD5 hash:	e819a317bfb0ccc49cf098939cfc303d
MIME type:	image/png

File name:	DBN_LAST
File size:	2'950 bytes
SHA256 hash:	9d1556cad05e9ef7498be25211c2abea69d66270d8de7d458040aa7185647eb2
MD5 hash:	9fa1f45e9a1514f5c35a875e5bfc8d6e
MIME type:	image/png

File name:	DBN_NEXT
File size:	2'938 bytes
SHA256 hash:	dbab080861d0706bf91e2ddf838fe59caa7ed10fbead23fba50486ee8a1a7cfa
MD5 hash:	4770d052548fd4c3843873936073a140
MIME type:	image/png

File name:	DBEDIT
File size:	2'851 bytes
SHA256 hash:	3bbbc4812365ded122f64ee8fe0075174eb6481bb8c711869b116ebf20e6a947
MD5 hash:	610f5d12ba0cc05604235dc2ba8505fe
MIME type:	image/png

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b1dcb828ab76d43a5b369a

Tags:

malware

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/38a651911849f0fc68b5c29d53e1724919a5228ffc24091d2836d16483c55f9b/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/38a651911849f0fc68b5c29d53e1724919a5228ffc24091d2836d16483c55f9b

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/38a651911849f0fc68b5c29d53e1724919a5228ffc24091d2836d16483c55f9b

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

13%

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery

Link:

https://tria.ge/reports/250216-qj2znaylfj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

Downloads MZ/PE file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/38a651911849f0fc68b5c29d53e1724919a5228ffc24091d2836d16483c55f9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PK_PUMP_AND_DUMP Create hunting rule
Author:	Will Metcalf @node5
Description:	Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)