MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5e33919c9c8b9b771de9edca9b7a7e6c243368165378e303e21b50eb37264561. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 5e33919c9c8b9b771de9edca9b7a7e6c243368165378e303e21b50eb37264561 |
|---|---|
| SHA3-384 hash: | 25ade876c50de08043c789d3e4dc46d4f84b990e87a4ab75cd9a94eb588f5fccc358eca25749393b02769b25db1dea7f |
| SHA1 hash: | 4508b095f3fa7e032f6aeae243a1a4faa28f88c7 |
| MD5 hash: | 70d668ee7892393824f31c73d5d445fb |
| humanhash: | nine-cardinal-ohio-lemon |
| File name: | win11debloat-october-version-2025.zip |
| Download: | download sample |
| File size: | 136'205 bytes |
| First seen: | 2025-12-02 08:27:38 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 3072:suXNHZqknjguHziOWiv+ApxFSqMZLuyMGFSdVfIE3q:suXfkuH++H8lQyMGUfI/ |
| TLSH | T122D33AE808106C12FEE6F4FB272A1581DE12E590B6C43769C251B27DF9072381E9D6FE |
| Magika | zip |
| Reporter |  juroots |
| Tags: | zip |
Intelligence
File Origin
# of uploads :
1
# of downloads :
26
Origin country :
CHVendor Threat Intelligence
Details
No details
Verdict:
Suspicious
Score:
50%
Tags:
infosteal
Result
Verdict:
SUSPICIOUS
Link:
Details
Hidden Powershell
Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.
Verdict:
Unknown
File Type:
zip
First seen:
2025-10-08T15:03:00Z UTC
Last seen:
2025-11-30T12:27:00Z UTC
Hits:
~10
Score:
5%
Verdict:
Benign
File Type:
ARCHIVE
Verdict:
Malware
YARA:
3 match(es)
Tags:
DeObfuscated PowerShell Zip Archive
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
execution persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Power Settings
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
zip 5e33919c9c8b9b771de9edca9b7a7e6c243368165378e303e21b50eb37264561
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.