🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48a59ece169b2ea9098c8aaa71456fb18c58726da08e28514f90fb5786f66ff2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48a59ece169b2ea9098c8aaa71456fb18c58726da08e28514f90fb5786f66ff2
SHA3-384 hash: 97efe9def055dfd08c3ae0f047fb9fb39a0459ff5e742f51d4eeef1aba7b5aef1f09f771a15ce385a09e747e52336e85
SHA1 hash: cb8711491fc9c6d6daee7133b895c3ebfc2a3e31
MD5 hash: ae14d8b2c0b2e74a06b11af2a2d51529
humanhash: quiet-freddie-nineteen-north
File name:48a59ece169b2ea9098c8aaa71456fb18c58726da08e28514f90fb5786f66ff2.bin
Download: download sample
File size:94'593 bytes
First seen:2026-09-27 14:10:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:ni8y8Ziv4hASnigBH1726k7LxFHDxlXaJxxKUXOGlbnTcOyyfmav/8p:iqZiAhASigB8jJDxUXxKSdnhgav/a
TLSH T1BF93023C690BAA2D9090F6F5CD8EE478A1B3F4BB849412F4B3D1A3B1EE057566C417C9
Magika zip
Reporter whack_sh
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
US US
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:OVERHAU#L0.2.exe
File size:132'121 bytes
SHA256 hash: cc7ed8925c59a12401b16edbe96a730bd06d11724778024fb42b0cfbf271e7bc
MD5 hash: 400b762c95a20e6eb67d7ea8cbb2f423
MIME type:application/x-dosexec
File name:OVERHAU#L-safety-0.2.exe
File size:167'612 bytes
SHA256 hash: 804bc50d22fdcb8eb8c926e0a231ad6683fc9eb5134fe13a74746188d14ee284
MD5 hash: 1f52268eeb83affffcb9f89eae11fc09
MIME type:application/x-dosexec
File name:readme.txt
File size:2'027 bytes
SHA256 hash: 9382d94feb9acf12119ebcb9e60fb1b0ae5b8b081898ed2598e9ba054874d726
MD5 hash: 59120326b4f4397490214acb0504d32b
MIME type:text/plain
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6e7f7742-78d0-42a8-a9f0-2995cf4382a5/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.65925946.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac0b65959bf6e2f9e92bafc
Tags:
injection badjoke virus
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug mingw overlay packed
Link:
https://www.filescan.io/uploads/6ab92406289a09f5b0791d3b/reports/578c4da5-e5b0-4d6f-9978-3251092d1d13/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/48a59ece169b2ea9098c8aaa71456fb18c58726da08e28514f90fb5786f66ff2
Verdict:
Adware
File Type:
zip
First seen:
2025-06-14T18:01:00Z UTC
Last seen:
2025-06-14T18:42:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/48a59ece169b2ea9098c8aaa71456fb18c58726da08e28514f90fb5786f66ff2/results?tab=lookup
Score:
82%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/48a59ece169b2ea9098c8aaa71456fb18c58726da08e28514f90fb5786f66ff2
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/ae14d8b2c0b2e74a06b11af2a2d51529
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48a59ece169b2ea9098c8aaa71456fb18c58726da08e28514f90fb5786f66ff2/
Threat name:
Win64.Trojan.BadJoke
Create hunting rule
Status:
Suspicious
First seen:
2025-04-14 19:04:00 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jcsz5tqwtmxkscmmrkvhcrlpwggfq4tnuchcqukpsd5vpbxwn7za._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260927-vmgv4ssx8k/
Behaviour
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:test_rule_vldslv
Create hunting rule
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 48a59ece169b2ea9098c8aaa71456fb18c58726da08e28514f90fb5786f66ff2

(this sample)

  
Delivery method
Distributed via web download

Comments