🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ca026915d697c052ce56cb6024ef7d11b30155694642b374b29c3ea23be5ec8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ca026915d697c052ce56cb6024ef7d11b30155694642b374b29c3ea23be5ec8
SHA3-384 hash: 930ae3e3f0475b01ff61029664bb46c0668654757b474a85ad36fe42e41254e2a6467d73e571bc0ca5a59e47fd47b8f0
SHA1 hash: 5681e7d3c93f61a33eda4bc1b4db5cab938f0c3d
MD5 hash: 305eefa85968ee33d362cfd2f87bdb89
humanhash: chicken-lima-mars-equal
File name:7ca026915d697c05.bin
Download: download sample
File size:1'539'564 bytes
First seen:2026-10-05 07:24:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:ik7SDVrTjaYRz9P4vnMuUFkc7kNqhb6k7SDVrTjaYRz9P4vnMuUFkc7kN2h8:376XuYRz9P4fMLku76XuYRz9P4fMLk7
TLSH T12D65337ECBB86BE5C7D45194B0BAF7EE5DA0E8A6240DF365F6C0260036396D50612F32
Magika zip
Reporter whack_sh
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
US US
File Archive Information

This file archive contains 11 file(s), sorted by their relevance:

File name:AVA.js
File size:62'658 bytes
SHA256 hash: 9c79aaebddd54562eddb9050a8c60b816579f232ce72712a23ba12a29b0fe922
MD5 hash: 8b51818f77ef9d996993cb701fc8d30c
MIME type:text/html
File name:avatar.js
File size:46'803 bytes
SHA256 hash: 59e15d720af1680d15767bb3418db7a0b9cbd118d2f8d7fefcdd44ed7d805cd9
MD5 hash: 5ccc95fb02025761a27a9e3f94c67e92
MIME type:text/html
File name:package.json
File size:180 bytes
SHA256 hash: bb9e090f960dfc05524a5ab0f885212f394c4d836e201870d04146dc28303fe6
MD5 hash: ba467e475a6eb340530451eeed4f5456
MIME type:application/json
File name:hold.js
File size:62'640 bytes
SHA256 hash: bef0bfb980376faa2c9ca2fbc523a2608e9728fa653fe3a8eb6a08ce073ddf24
MD5 hash: 4f09c780546b8173673b303207185fe3
MIME type:text/html
File name:main.py
File size:4'872 bytes
SHA256 hash: 7f171f6d99dcaba245e02d62789f9828457e1343c8d9bf46a095c3a1bf829514
MD5 hash: 0c85cb759835b8bb89c076ae3e08884c
MIME type:text/x-python
File name:proxy.txt
File size:1'140 bytes
SHA256 hash: 6baa58a0ea46d2dbcbd1b8bbf3dddd2560665bc440437051f5d745e604fb59c4
MD5 hash: a7b5338a71b142586863596ec0cca830
MIME type:text/plain
File name:package-lock.json
File size:29'577 bytes
SHA256 hash: d4a61e2d57db28fde2e503d692db211c62398a1364740c2b43b3061d4beb446b
MD5 hash: 46984c53b15224db81ab82221a8fbd59
MIME type:application/json
File name:http-supernova.js
File size:45'957 bytes
SHA256 hash: 5183dd22d466a1a7ed7422ae59284d5d6709f893e61500b2dd006a38f38d1777
MD5 hash: a6a40da999d19a8773675329e05f70e1
MIME type:text/html
File name:mix.js
File size:45'034 bytes
SHA256 hash: 84a22145e1ec386bd93ff917e554f3ff0aa55dbc85dfdcab99f1b8e2b70eb48a
MD5 hash: 88f2a4912411c2b6dabf4e2c0a640482
MIME type:text/plain
File name:ua.txt
File size:8'928'623 bytes
SHA256 hash: 29571a2a087568581e10468f1cd944232238a6597709a89116d3e50b5b9d2b16
MD5 hash: 1f6ce0cd4e8c9c1ec544f2e9ed732a81
MIME type:text/plain
File name:scrape.py
File size:123'354 bytes
SHA256 hash: e9d527b2d7a439d1c337a5bb3aa4748c403451d97765d4da23664f204f7139e6
MD5 hash: 538bdb4cef8f449b7927bbbdc49e7188
MIME type:text/x-python
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/79c81094-fdb1-4a0d-93b7-106e209e564a/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.81060462.7422.12957.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/7ca026915d697c052ce56cb6024ef7d11b30155694642b374b29c3ea23be5ec8
Verdict:
Unknown
File Type:
zip
First seen:
2026-08-07T11:28:00Z UTC
Last seen:
2026-10-05T07:49:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7ca026915d697c052ce56cb6024ef7d11b30155694642b374b29c3ea23be5ec8/results?tab=lookup
Score:
58%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/7ca026915d697c052ce56cb6024ef7d11b30155694642b374b29c3ea23be5ec8
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Zip Archive
Link:
https://app.malva.re/file/305eefa85968ee33d362cfd2f87bdb89
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ca026915d697c052ce56cb6024ef7d11b30155694642b374b29c3ea23be5ec8/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-07 03:30:58 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
4 of 36 (11.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=psqcnek5nf6aklhfns3aetxx2entafkwsrscwn2lfhb6ui56l3ea._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/261005-jarn1awhnh/
Behaviour
Command and Scripting Interpreter: JavaScript
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7ca026915d697c052ce56cb6024ef7d11b30155694642b374b29c3ea23be5ec8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:has_telegram_urls
Create hunting rule
Author:Aaron DeVera<aaron@backchannel.re>
Description:Detects Telegram URLs
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NSVPS_Hydra_SSH_Bruteforce
Create hunting rule
Author:sanad (NSVPS-SOC)
Description:Hydra SSH brute-force campaign credentials pattern from NSVPS honeypot
Rule name:ScanStringsInsocks5systemz
Create hunting rule
Author:Byambaa@pubcert.mn
Description:Scans presence of the found strings using the in-house brute force method
Rule name:SUSP_Websites
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference of suspicious sites that might be used to download further malware
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Web_Generic_Binary_URL_Download
Create hunting rule
Author:Serhii Kocherhan
Description:Detects files containing HTTP or HTTPS links pointing directly to .bin payload extensions.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 7ca026915d697c052ce56cb6024ef7d11b30155694642b374b29c3ea23be5ec8

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3898573/

Comments