🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4472b8c557a3b5ad7b4a83034a4f7a40269074088bfde6902eda066c7dbfe77b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4472b8c557a3b5ad7b4a83034a4f7a40269074088bfde6902eda066c7dbfe77b
SHA3-384 hash: 14e08534ec2698eb1f3c0bdc6d8c661241dc115c39c15af5ee1d52fad2633f05589446e273e8578c7a1e760668246109
SHA1 hash: 6b977a2c2ab1a5d1c70f83bf8dac479c40ea6fdd
MD5 hash: ca8dde2e1e412c4c62643d6353c78015
humanhash: oregon-missouri-skylark-saturn
File name:penis.zip
Download: download sample
File size:198'482 bytes
First seen:2026-06-23 06:56:45 UTC
Last seen:2026-06-23 06:57:20 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:AGq8Nh2q8HwGq8Nh2q8HuGq8Nh2q8HcGq8Nh2q8HuGq8Nh2q8HCPBy44I3h+0Vr:AGq8Nh2q8HwGq8Nh2q8HuGq8Nh2q8Hc9
TLSH T1EE144A0966F85B67E5BA1BBA16BE2150077F7112E832E74D0ACCE0DA1BE37120791F53
Magika zip
Reporter smica83
Tags:CVE-2025-6218 CVE-2025-8088 zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
138
Origin country :
HU HU
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:PonosDedaRemix.exe
File size:26'624 bytes
SHA256 hash: 7ea0d8806e2307fc639cfdf6eb05d8bf4048ff93ba63c012da4938189a7ea1f8
MD5 hash: efeb5bcb57527064b65031151e9fb3b4
MIME type:application/x-dosexec
File name:Hi.png
File size:63'822 bytes
SHA256 hash: 1768cdb8c1052dd22db0d22858e430d86a246ed41f92301084c7b27134b5e76a
MD5 hash: 8a432ccc9f22e23b2e32e8be0cdc29c2
MIME type:image/png
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/fc2cedd2-0561-4827-9303-951c607238a0/
Detection(s):
Sanesecurity.Malware.32297.CVE-2025-6218.Zip.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a3a2e6386bc95245bf8d45c
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 ransomware
Link:
https://www.filescan.io/uploads/6a3a2e6590632a45f734eb11/reports/70dbf453-c0d8-4906-a6ff-62df36121253/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4472b8c557a3b5ad7b4a83034a4f7a40269074088bfde6902eda066c7dbfe77b
Verdict:
Malicious
File Type:
zip
First seen:
2026-02-18T03:42:00Z UTC
Last seen:
2026-06-24T22:11:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/4472b8c557a3b5ad7b4a83034a4f7a40269074088bfde6902eda066c7dbfe77b/results?tab=lookup
Score:
55%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/4472b8c557a3b5ad7b4a83034a4f7a40269074088bfde6902eda066c7dbfe77b
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4472b8c557a3b5ad7b4a83034a4f7a40269074088bfde6902eda066c7dbfe77b/
Threat name:
Binary.Ransomware.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-06-19 11:23:23 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
4 of 38 (10.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=irzlrrkxuo22262kqmbuut32iatja5airp66nebo3idgy7n7455q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260623-jshh2sbv7y/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/4472b8c557a3b5ad7b4a83034a4f7a40269074088bfde6902eda066c7dbfe77b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ZIP_PowerShell_Susp_Obf
Create hunting rule
Author:ventdrop
Description:Detect .zip files containing susp and obf embedded PS command

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments