MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fd67dcdaeced3ab38c6686a5c357172f1a02e14df6506d81e985bed62995adb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PavinLoader

Vendor detections: 5

Intelligence 5 IOCs YARA 16 File information Comments

SHA256 hash:	6fd67dcdaeced3ab38c6686a5c357172f1a02e14df6506d81e985bed62995adb
SHA3-384 hash:	a7893e5d56c1a01ea18336dbbee4a353175e7965fcba94995b06077a4461a2e76686a0ff6ad6c6ac13029019420133d5
SHA1 hash:	e61257a9d5239c3b85525bd7d259e8452e830092
MD5 hash:	db26441f25df881b0491e9ebd8f7a772
humanhash:	bakerloo-music-avocado-florida
File name:	Install37371o040.zip
Download:	download sample
Signature	PavinLoader Create hunting rule
File size:	16'483'441 bytes
First seen:	2026-08-14 12:46:40 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:/tD0q5PEamWwtwckdZ2/rtxdOWBDFHgsqCZ2FO:55cjWnx2tyW3HgsqCZH
TLSH	T1B0F6331AE2E8046B38EFBBA9DD2E5FE4507C519C9F1B19AC5F720C341021C659EB31DA
Magika	zip
Reporter	aachum
Tags:	feafetoboary-lol kefaisce-cfd PavinLoader zip

iamaachum

https://start2playmusic.com/c9bhl9k.php => https://workshop.avatar4devs.com/u

IOCs:
https://kefaisce.cfd/aKVbz/get/DropoutSwifter.js
feafetoboary.lol

Intelligence

File Origin

# of uploads :

# of downloads :

134

Origin country :

File Archive Information

This file archive contains 8 file(s), sorted by their relevance:

File name:	samples.pak
File size:	1'812'753 bytes
SHA256 hash:	107439323b24494fb7d7fe08e841e201af9f355a17f0d6065ebf43b4bda341be
MD5 hash:	724e861ab8499db28af5c0be3292061f
MIME type:	application/octet-stream
Signature	PavinLoader

File name:	Castle.Core.dll
File size:	14'667'776 bytes
SHA256 hash:	a7a153028d5dc6adb55162c312d356fa5817e68c0b0106dce8c61cd587df2986
MD5 hash:	08451924a83c85da675c58b775eb6f8e
MIME type:	application/x-dosexec
Signature	PavinLoader

File name:	database.db
File size:	1'758'538 bytes
SHA256 hash:	e03c15a0d266af53c0677e3a340b76d99417df7c815b1317406097485d1f5783
MD5 hash:	4a021b8e0239ad762bf2ae9e74877557
MIME type:	application/x-sqlite3
Signature	PavinLoader

File name:	data.pak
File size:	1'958'003 bytes
SHA256 hash:	6173dcf019abde5deb0e58c3ac1e9f192f1fe2859707c5a9e5923fbbe92a611d
MD5 hash:	9be8937143a566a321b077090a824d1a
MIME type:	application/octet-stream
Signature	PavinLoader

File name:	Installer.exe
File size:	252'312 bytes
SHA256 hash:	3d2b22b6bc51e0918263f4420e6bdf7d982d961b54176c470cac11841d1c9b33
MD5 hash:	2d6ebd59b568586a8f1683b07de897e1
MIME type:	application/x-dosexec
Signature	PavinLoader

File name:	README.txt
File size:	2'833 bytes
SHA256 hash:	8f50b30aea0c72aef98a29e9d49877ec768aded19ee8c179cf18add8b4aae85a
MD5 hash:	d566a89c894da850de8e7fa0f72c9da9
MIME type:	text/plain
Signature	PavinLoader

File name:	Installer.csproj
File size:	546 bytes
SHA256 hash:	113352335c0346b23a24284e35c221f40aaee643d043d20aedc45581578755d1
MD5 hash:	74e98a498ffa5cc54c81a7c9cb841057
MIME type:	text/xml
Signature	PavinLoader

File name:	LICENSE.txt
File size:	4'370 bytes
SHA256 hash:	5c789cbc3586e6a4cbfa4d29083d014a0b9b99a220cb83891803c0f80ad33c4e
MD5 hash:	3252c142541ecd9719612fe7155febbb
MIME type:	text/plain
Signature	PavinLoader

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b6969979-eec1-4176-9da2-9485b4272fb5/

Result

Verdict:

Clean

File Type:

PE File

Link:

https://app.docguard.net/6fd67dcdaeced3ab38c6686a5c357172f1a02e14df6506d81e985bed62995adb/results/dashboard

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6fd67dcdaeced3ab38c6686a5c357172f1a02e14df6506d81e985bed62995adb

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/6fd67dcdaeced3ab38c6686a5c357172f1a02e14df6506d81e985bed62995adb/results?tab=lookup

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/260814-sr77raw1gt/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.56

Link:

https://yomi.yoroi.company/submissions/6fd67dcdaeced3ab38c6686a5c357172f1a02e14df6506d81e985bed62995adb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Any_SU_Domain Create hunting rule
Author:	you
Description:	Detect any reference to .su domains or subdomains

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETDLLMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.