MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6472d2f027e25639b98381affdeb6932a82a530aa593198d6d85f99a1d74c114. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 16 File information Comments

SHA256 hash:	6472d2f027e25639b98381affdeb6932a82a530aa593198d6d85f99a1d74c114
SHA3-384 hash:	86ec51945b1adea50dc9a6926063e2887485733d014cef7eba7c74ac3ab019631b42f89d14d279030875a4adb2d8d498
SHA1 hash:	50772bebee7ae62d256e69324201fb87fa25d5b3
MD5 hash:	e6ee893eee0861300179763421182a40
humanhash:	north-happy-lima-earth
File name:	6472d2f027e25639b98381affdeb6932a82a530aa593198d6d85f99a1d74c114
Download:	download sample
File size:	16'561'905 bytes
First seen:	2025-09-27 18:32:44 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:/bc2B6NUas4UYxXEkj07GuQGxlf2oCcUkYf0xGVuf0/OqaVFvY:/b/qVUiEQ0iGCc35GVEkqvY
TLSH	T1ADF63336B4D29CB4FF0D74303D8A456EE4AC64BBE9D3229B7E74930653663E9079620C
TrID	60.0% (.USDZ) Universal Scene Description Zipped AR format (generic) (6000/1/1) 40.0% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	WhichbufferArda
Tags:	APT44 backdoor kalambur Sandworm zip

WhichbufferArda

June 2025, KALAMBUR backdoor. Delivered with Signal Messenger.

Intelligence

File Origin

# of uploads :

# of downloads :

113

Origin country :

File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:	Uninstaller.exe
File size:	16'802'160 bytes
SHA256 hash:	64978f247fe53835a7d4c90e63a6f7ae4884e14bd52d115e81673382b59fc314
MD5 hash:	758776631d6070b18f3b1432df0fe734
MIME type:	application/x-dosexec

File name:	ESET Online Scanner.exe
File size:	503'360 bytes
SHA256 hash:	a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e
MD5 hash:	d8a498d3ed32fa33ff9c2e1a20e984da
MIME type:	application/x-dosexec

File name:	README.txt
File size:	419 bytes
SHA256 hash:	9a5234c8b0debc5c1b8c6c2ca79169d6376070f0665b79e2c71bf0c23c201a0d
MD5 hash:	e8fa58daee646088d04033d7c30428bd
MIME type:	text/plain

File name:	Support.txt
File size:	54 bytes
SHA256 hash:	c9acdd06df16c8cd5732228c9cf50e2c3e12bed81a905c0a0e29e780427bf156
MD5 hash:	fae91cb9ce54727e4ca2b0e8d826f7ec
MIME type:	text/plain

File name:	Licence.docx
File size:	16'907 bytes
SHA256 hash:	e117db1f80603c3b02b6d963323440ece3b8b93c61509102fc7cee16dfe7304f
MD5 hash:	a0d906c938c8311ebe98d746a8de8af6
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

TwinWave.EvilZip.OnAndOn.20221219.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68d82e0afb8bc5050e4f1d3d

Tags:

infosteal virus spawn sage

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug evasive fingerprint microsoft_visual_cc overlay packed signed

Link:

https://www.filescan.io/uploads/68d82e066c140e5b35fed80f/reports/4bc6bb98-ee5a-4a3e-83c4-c52b52d151bc/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6472d2f027e25639b98381affdeb6932a82a530aa593198d6d85f99a1d74c114

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/6472d2f027e25639b98381affdeb6932a82a530aa593198d6d85f99a1d74c114/results?tab=lookup

Score:

92%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)