MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70471d4dfd6c201ed4a9505023f7190aa69ddcfa393cc3798fe4d009cf7aa186. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	70471d4dfd6c201ed4a9505023f7190aa69ddcfa393cc3798fe4d009cf7aa186
SHA3-384 hash:	ac9bb00a44053d7edc93442f422ee29a8cffa6906ed4e184a2ac0cb945b6c1a25240f40895a7405dd640e93ec6383ede
SHA1 hash:	d2dc3d2ef48c9cc5255ed105b623e446e4947d9f
MD5 hash:	88226da1c1917fdbf9b8d1466b120b06
humanhash:	six-robert-ohio-cardinal
File name:	m1n.zip
Download:	download sample
File size:	21'955'076 bytes
First seen:	2026-07-18 09:06:32 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:wCo14YI575UKV5EgP0HJbQOlt3GC6jirvm6u+vV9r1BPWCpFD8uXd8G0wim74:814Yy75rV5XP0HJbQO/36irvm6XV95B6
TLSH	T15D273383C11A17A6DA4FBF3133FB113B5668D21CB12AA59B3E1153D02CE17D66F23A16
TrID	67.5% (.WHL) Python Wheel package (25000/1/5) 21.6% (.XPI) Mozilla Firefox browser extension (8000/1/1) 10.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	smica83
Tags:	zip

Intelligence

File Origin

# of uploads :

# of downloads :

174

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ab15fe09-3cf6-422f-9804-402664b33fd1/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a02f167e8c512322820775a

Tags:

n/a

Verdict:

Suspicious

Labled as:

Virtool.Generic

Link:

https://www.hybrid-analysis.com/sample/70471d4dfd6c201ed4a9505023f7190aa69ddcfa393cc3798fe4d009cf7aa186

Verdict:

Malicious

File Type:

zip

First seen:

2026-07-10T04:59:00Z UTC

Last seen:

2026-07-20T04:50:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/70471d4dfd6c201ed4a9505023f7190aa69ddcfa393cc3798fe4d009cf7aa186/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/