🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5
SHA3-384 hash: c9277f5064a029dbe01c40a3bfc3ec1e561b9279b83c0936fe4a782fe345754afa31ba650d5234469a1434d2f9da6918
SHA1 hash: ff6733409e27565058ee84ec556e3f6cc8ffdcd0
MD5 hash: fdb5b1c351ef0edfef254ff89a173fd6
humanhash: fruit-carolina-maryland-violet
File name:427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5.bin
Download: download sample
File size:118'034 bytes
First seen:2026-09-30 05:10:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:vTySkDZ+RJlMn6w92zijjeUv9UmPuLTLLF:vGDFybS6Ojij0UvB
TLSH T1E2B31240A919A8248A2FFD76307888E2D524015060EEFE5F8FF5DF9E45571C0EED83AB
Magika zip
Reporter Tuxxin
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
US US
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:CrazyNCS.exe
File size:125'440 bytes
SHA256 hash: 6820c71df417e434c5ad26438c901c780fc5a80b28a466821b47d20b8424ef08
MD5 hash: d043ba91e42e0d9a68c9866f002e8a21
MIME type:application/x-dosexec
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/161091ea-6a4c-41ed-bdc5-69e398676b5d/
Detection(s):
Win.Trojan.Joke-15
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ace4a9f350c7ee8cc150946
Tags:
packed virus razy
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aspack borland_delphi dropper evasive fingerprint packed packed packer
Link:
https://www.filescan.io/uploads/6abc99ef151e7591585ad0d1/reports/409eb934-558c-4640-9ad9-89833a28a6ca/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5/results?tab=lookup
Score:
8%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/fdb5b1c351ef0edfef254ff89a173fd6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5/
Threat name:
Win32.PUA.CrazyNumCapsScroll
Create hunting rule
Status:
Malicious
First seen:
2024-04-04 04:59:33 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
22 of 38 (57.89%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ij57kmsnoiejqjoskozvcxangyk46zlch72zobnnhmwwund3ys2q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/260930-m895sadg29/
Behaviour
System Location Discovery: System Language Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:INDICATOR_EXE_Packed_ASPack
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ASPack
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5

(this sample)

  
Delivery method
Distributed via web download

Comments