MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 478604b0f9323082b61521045a310b3362f405a0781a735dfe72f8ffed054be7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	478604b0f9323082b61521045a310b3362f405a0781a735dfe72f8ffed054be7
SHA3-384 hash:	ffa71ee99984cee20f04f403b26df34d294635042d34bd8a597da46e3d7e9428154fabcf21780cadef15eadc3dc1e810
SHA1 hash:	3fb59fbdb31a57ec568afcc7a32e5279cf55eb1d
MD5 hash:	d682e9d45132c9a92828d2fba59676f8
humanhash:	aspen-stream-magazine-south
File name:	2-1180-25_24.06.2025.rar
Download:	download sample
Signature	Gamaredon Alert Create hunting rule
File size:	12'020 bytes
First seen:	2025-06-24 07:27:45 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	192:TmwhIGr1wQCCHLPDQJ0r7xUs5M5M5M5M5IxGeyG697UZC727M:Tm61jh40r9ULGeyxUZkJ
TLSH	T163427E38F1113A604AF222F7605EC8E9D4D7B8DB8A0F5F0B5606AE51EF189ACD915898
Magika	zip
Reporter	smica83
Tags:	apt gamaredon UKR zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

111

Origin country :

HU

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	2-1180-25_24.06.2025.HTA
File size:	4'183 bytes
SHA256 hash:	af860c5ce9401a7fed857169da9522966b5a5269b2a8a030aaf902299947eb5b
MD5 hash:	02b1394a8ee31ed7770e275b060b0837
MIME type:	text/html
Signature	Gamaredon

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685a53e5b06783b9ebd6cfb8

Tags:

phishing spawn overt sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/478604b0f9323082b61521045a310b3362f405a0781a735dfe72f8ffed054be7/results/dashboard

Payload URLs

URL

File name

https://lydiapvJ.com

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

lolbin mshta obfuscated

Link:

https://www.filescan.io/uploads/685a53cef8f8abe4f8b83c3c/reports/00a0de4f-9d21-4e72-ae2e-dd3ffa3bb240/overview

Hybrid Analysis HEUR/Suspar.Generic

Verdict:

Suspicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/478604b0f9323082b61521045a310b3362f405a0781a735dfe72f8ffed054be7

Nucleon Malprob Benign

Score:

20%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/478604b0f9323082b61521045a310b3362f405a0781a735dfe72f8ffed054be7

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Zip Archive

Link:

https://app.malva.re/file/d682e9d45132c9a92828d2fba59676f8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/478604b0f9323082b61521045a310b3362f405a0781a735dfe72f8ffed054be7/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Gamaredon

Threat name:

Script-WScript.Trojan.Gamaredon

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-24 07:30:06 UTC

File Type:

Binary (Archive)

Extracted files:

2

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i6dajmhzgiyifnqveecfumilgnrpibnapanhgxp6ol4p73ifjptq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery

Link:

https://tria.ge/reports/250624-mkezqs1yay/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Blocklisted process makes network request

Malware Config

Dropper Extraction:

http://google.com@document-downloads.ddns.net/OD/quitzU2/comparativelyNWU.jpeg

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/478604b0f9323082b61521045a310b3362f405a0781a735dfe72f8ffed054be7