MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63b61e78df22d07e318ed7af0dfd978cd7ad626c5b49bb737214a2311f828011. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	63b61e78df22d07e318ed7af0dfd978cd7ad626c5b49bb737214a2311f828011
SHA3-384 hash:	6d2cac63757d540492591306ed73858b6c8eda7590fffeb0049ee515197fc9341e19a0738813528b17e5cc5ea33481c1
SHA1 hash:	03cae596b6f362a8226f173b36831eb50c725e50
MD5 hash:	ed44e314b06fb530af9906abc50b8683
humanhash:	timing-connecticut-pennsylvania-wolfram
File name:	заседания_Священного_Синода_Русской_Православной_Церкви.zip
Download:	download sample
File size:	1'030'594 bytes
First seen:	2026-06-16 09:30:39 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24576:lhCM0A6zc0aijvhsxavdlaJDmp4f1oFkEXkcIGBZmOoA:lhf0Ao+wpsx0d8mg1+AGaK
TLSH	T1982522EBE331F8F6C334A2F5661F0352FC7CE58A8639A702912F61B1AE4B525034565B
Magika	zip
Reporter	smica83
Tags:	zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

77

Origin country :

HU

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d7dd1e92-a60d-419b-aeac-c209639961e4/

ClamAV Detected

Detection(s):

Win.Malware.Nymeria-7193906-0

Alert

Create hunting rule

Sanesecurity.Malware.28759.LnkHeur.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30777.LnkHeur.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilLNK.KingForADaypshell.20231121.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3117d054a045c340899001

Tags:

xtreme virus shell

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

LNK File - Malicious

Link:

https://app.docguard.net/63b61e78df22d07e318ed7af0dfd978cd7ad626c5b49bb737214a2311f828011/results/dashboard

Behaviour

BlacklistAPI detected

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/63b61e78df22d07e318ed7af0dfd978cd7ad626c5b49bb737214a2311f828011

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/63b61e78df22d07e318ed7af0dfd978cd7ad626c5b49bb737214a2311f828011/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/63b61e78df22d07e318ed7af0dfd978cd7ad626c5b49bb737214a2311f828011

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/63b61e78df22d07e318ed7af0dfd978cd7ad626c5b49bb737214a2311f828011/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-11 19:19:32 UTC

File Type:

Binary (Archive)

Extracted files:

219

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mo3b46g7elih4mmo26xq37mxrtl22ytmlne3w43scsrdch4cqaiq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution

Link:

https://tria.ge/reports/260616-m9klhsds4t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/63b61e78df22d07e318ed7af0dfd978cd7ad626c5b49bb737214a2311f828011