🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4
SHA3-384 hash: 202d3de4f1d7260a06c8e0d5b08962a54b5bb4bc1058be644bbc4cb0dd0afd52ff27ef856931b29cffdb7a4775fb501d
SHA1 hash: 3521e8990d23019af22394e7b776f6696cbabd1a
MD5 hash: d9df270686f05f68172b7ddef01ea197
humanhash: alabama-lithium-five-sink
File name:5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4.bin
Download: download sample
File size:5'348'169 bytes
First seen:2026-10-01 17:29:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:vMBXG8JhWYIzjjEKRfhBvIcPpvYyF3Pq3azbQDFj7aiyDs9PGga0mYXRsBB8OAH1:vMB28a5EKRfI2vY8A7xqs9uGjsPzDWt
TLSH T1433633E54C994F1D6E1BFFA3205AFDA02D41EFC8E27D2AD58F125DF80A618C01E8D5A4
Magika zip
Reporter Tuxxin
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
US US
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:maestro.exe
File size:12'908'961 bytes
SHA256 hash: 0f2a12fb2dc7eccb2e8cf2efb051535b077d49d994a9c96fb6f31e7455555341
MD5 hash: 95d0b45de97d9df4e2416c04d6470fe8
MIME type:application/x-dosexec
File name:LICENSES\silkscreen-OFL.txt
File size:4'394 bytes
SHA256 hash: 86c5e9c9382cdcc5948704fdfe60f2aa164a719746931219a42736ecd9cefbd3
MD5 hash: 7cbbc700e264e05ac8cc38b2d7e851f1
MIME type:text/plain
File name:LICENSES\IBM-Plex-OFL-1.1.txt
File size:4'456 bytes
SHA256 hash: 7e6b2818edbd8f6a01ae80641cc8f16a51080d08fb4e532be3a0b6f74adb07da
MD5 hash: 4d4949dda4b23922e334f0cbf6179065
MIME type:text/plain
File name:LICENSES\pixelifysans-OFL.txt
File size:4'488 bytes
SHA256 hash: b66ba46f511a851ab09998b5a5a9fdbb102545a3864cb993095e1745996873a7
MD5 hash: 32b251b4f2beb9af0bae73f2aecb4622
MIME type:text/plain
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/aac344b5-aeba-40db-94a1-4ffc838e1165/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acecc70350c7ee8cc153b24
Tags:
n/a
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto fingerprint keylogger overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6abe98bb868a15787acf8f3e/reports/c66c1585-8db2-4679-b6eb-7e996498e4aa/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4/results?tab=lookup
Score:
91%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/d9df270686f05f68172b7ddef01ea197
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lqmdbibxojyobxlllhexihepxlu56zre2h6kdp7xwcy7dbmndtka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MULTI_Malware_Unknown_ForgeAuto_9d9a5cf9
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_de8d8480
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 5c1830a0377270e0dd6b59c9741c8fbae9df6624d1fca1bff7b0b1f1858d1cd4

(this sample)

  
Delivery method
Distributed via web download

Comments