MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81211ba1f8a83c896b940515ca1da63e09856405e103a870c3d093f07fdd0dab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81211ba1f8a83c896b940515ca1da63e09856405e103a870c3d093f07fdd0dab
SHA3-384 hash: 2dabc20ac0bb388c491e7f40e73e8d062ebd18ed3187b4574853ec625be6e9542bc072d947da067380d2484b90919538
SHA1 hash: 9a7d70fa69f98090fbf18148fce094bf2a0bb887
MD5 hash: eed3f7b9486f532bda5d142ef5bc2e46
humanhash: zulu-nuts-sweet-lactose
File name:tivonage-0.21.zip
Download: download sample
File size:4'151'756 bytes
First seen:2025-11-18 07:49:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:DEtBKDqA/OGT0UlLPuzwmgJjci/tw8u04qtQWrhH:DEtBjA2Y0RzwhZU8uEach
TLSH T1111633FF0DCD351B470263BB2D2A72FD221FA715258E5DF5B150A92C9E118C942FAA83
Magika zip
Reporter juroots
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
32
Origin country :
US US
File Archive Information

This file archive contains 23 file(s), sorted by their relevance:

File name:lame_enc.dll
File size:175'104 bytes
SHA256 hash: e79b6620cda49009299705b27460dd1280eee0e9ab4beeb195e10973f0c6eee2
MD5 hash: 7f7c143de633f408cedaae90121d0b7a
MIME type:application/x-dosexec
File name:run.bat
File size:960 bytes
SHA256 hash: c63185fc3fb4f2fed3fb78273c29b14fd06c9a40b9f4b24124c7e4039f2ce2ba
MD5 hash: 8662bc6293e4c3b97a0bad6c060dd32e
MIME type:text/x-msdos-batch
File name:config.bat
File size:609 bytes
SHA256 hash: 34413e6ffe423194fb980f0ebf06cc8b503f25438670369e7e9e5495996b95c1
MD5 hash: 4d801b0800331cb8d264f0a20f0c86f0
MIME type:text/x-msdos-batch
File name:lame.exe
File size:202'240 bytes
SHA256 hash: 46e5c4d957dd20619203dcf3e730203562fcf946ac946426346c9ebfdeccdbf4
MD5 hash: 5a29378593beda73d0003b256671102b
MIME type:application/x-dosexec
File name:sox.exe
File size:736'403 bytes
SHA256 hash: 2b59c5574015c143ed548f30ebc37c798948cc8e1dd9f383cb49cb63ff82648f
MD5 hash: 0e2be870d1957acec85dbf51b362be26
MIME type:application/x-dosexec
File name:CHANGES.txt
File size:631 bytes
SHA256 hash: 2126f9736fdc8b64a96c20705854552b3140506c3378902ba38389dc47ae825e
MD5 hash: 70a6ed180db66567c5969197f80c1990
MIME type:text/plain
File name:sox12179.zip
File size:533'766 bytes
SHA256 hash: 08a2d2a7620f0e6b0b785da353e6a90af690836a498ba4dc6f77b3f66d55974a
MD5 hash: 1ad26e4dea4adc323c7ae8d880282550
MIME type:application/zip
File name:xmlParserAPIs.jar
File size:123'705 bytes
SHA256 hash: 00e7ff4fb2f424bb3c6031b6e7ad03c2badf7af08c1798c8ede6a5d7b7843520
MD5 hash: d96b62c9d7c2a81efd1986b59582e4e1
MIME type:application/zip
File name:config.sh
File size:819 bytes
SHA256 hash: 9fa401c912eacadd64d3c145fe0000211de17a22d8f2173a8994dff7117bee33
MD5 hash: 2769f4995a01623b623d2a1687c0068e
MIME type:text/x-shellscript
File name:xercesImpl.jar
File size:927'669 bytes
SHA256 hash: d1ff701c93fdd4838b95ccef54b83b3f2f9200052fe34fe8b82a0fbabfc1a72c
MD5 hash: 17c7b058d32d6df45456e1728a299ba1
MIME type:application/zip
File name:encode.bat
File size:70 bytes
SHA256 hash: 3ef4a0a64b9317b842824d5a3dd389fd03a9ae0aa6251913902684d89360e3b8
MD5 hash: 99fb9268238c059c1e7f24f3fb5cad7e
MIME type:text/plain
File name:js.jar
File size:597'407 bytes
SHA256 hash: d817bcb40cfa7c237d5619421db98e0dcb9f68f863c296ac045b9134b61596fa
MD5 hash: c8d70c3e0d5c7275ae57237b1d15d87a
MIME type:application/zip
File name:nekohtml.jar
File size:67'115 bytes
SHA256 hash: 375e70b97500b23f5ce79f65de6576452c4f8062b48b96afc83ddf1f1c35a1c2
MD5 hash: ae4103949249f9b08725a0529413934f
MIME type:application/zip
File name:bananas.jar
File size:39'550 bytes
SHA256 hash: a4deb12b0e28297209451f36ac05b9239424100987e2e1cea37c5658c388136f
MD5 hash: 99c60b88b87378065091f659c37e5464
MIME type:application/java-archive
File name:hme.jar
File size:143'155 bytes
SHA256 hash: 98e4dc773aff4b259eebd3b7291d03515aaef4c6edf4400b56091d1ce3247c52
MD5 hash: 7bbc3e601f94d374e8ef3f69fa6f360e
MIME type:application/java-archive
File name:README.txt
File size:2'891 bytes
SHA256 hash: 07613a66945b6a2adcb1f992f251596ab44566e20d513f4dcf28898762778fce
MD5 hash: d89a196f674336f7b22261852006a50a
MIME type:text/plain
File name:lame-3.96.1.zip
File size:614'943 bytes
SHA256 hash: 0ca859f383a1b3a88eec1946128b48316d0a8a9a6f3a8d549a1c3209f146452c
MD5 hash: ff7cca95ed22552883be960c1f2d85ca
MIME type:application/zip
File name:httpunit.jar
File size:410'888 bytes
SHA256 hash: fba8fb4edcdb2dad9e20d7db9eb5c66c78f4e1970f04074f9cc50eb1e3bf1e20
MD5 hash: 83af05446973ceeb8285505aca2763e0
MIME type:application/zip
File name:encode.sh
File size:83 bytes
SHA256 hash: a361cfd801d9d11fbe5665ebb61e74d87963b12feafaa613fc77340d05e0e3f3
MD5 hash: 6f9c9dc22783aade76778ca8f7d8380f
MIME type:text/x-shellscript
File name:tivonage-0.21.jar
File size:305'070 bytes
SHA256 hash: 02035eb9827c5b5881c970ec551d6d411b6a5e4ac24f668ecf65c6aca9e8ec5f
MD5 hash: 68b6cbddd6bf0391bfe379cd203ecda5
MIME type:application/java-archive
File name:run.sh
File size:1'008 bytes
SHA256 hash: c0a6422a420d16c44fa5e85bdeaebb9bdd00d02e7cb4b702073838671eb6a8f0
MD5 hash: 701a42a56941379d1a8cd539acd1ece5
MIME type:text/x-shellscript
File name:LICENSE.txt
File size:3'575 bytes
SHA256 hash: 02e4618eeceebb4949926edcd40d08af5bc2d93f6aa40298d7adb3cb174b1f69
MD5 hash: 552ca8cf345ecc7e11d3054a2f09bc3c
MIME type:text/plain
File name:vonaje-0.31.jar
File size:12'549 bytes
SHA256 hash: 180f191d18e1bca25d4fb5e1681651a626a5faa51298b3dd797f080385319e4d
MD5 hash: a97b7d4d027a72108d4e5217713525f1
MIME type:application/java-archive
Vendor Threat Intelligence
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691c2518bdb0ec3a9dc30955
Tags:
malware
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/81211ba1f8a83c896b940515ca1da63e09856405e103a870c3d093f07fdd0dab
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/81211ba1f8a83c896b940515ca1da63e09856405e103a870c3d093f07fdd0dab
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Clean
File Type:
unknown
First seen:
2010-07-23T12:28:00Z UTC
Last seen:
2017-08-26T04:49:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/81211ba1f8a83c896b940515ca1da63e09856405e103a870c3d093f07fdd0dab/results?tab=lookup
Score:
4%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/81211ba1f8a83c896b940515ca1da63e09856405e103a870c3d093f07fdd0dab
Verdict:
Malware
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Scripting.FileSystemObject WScript.Shell Zip Archive
Link:
https://app.malva.re/file/eed3f7b9486f532bda5d142ef5bc2e46
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81211ba1f8a83c896b940515ca1da63e09856405e103a870c3d093f07fdd0dab/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qeqrxipyva6is24uauk4uhnghyeykzaf4eb2q4gd2cj7a765bwvq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery linux upx
Link:
https://tria.ge/reports/251118-jwracs1phw/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/81211ba1f8a83c896b940515ca1da63e09856405e103a870c3d093f07fdd0dab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DevC4992BloodshedSoftware
Create hunting rule
Author:malware-lu
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MinGWGCC3x
Create hunting rule
Author:malware-lu
Rule name:UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_3
Create hunting rule
Author:Kevin Falcoz
Description:UPX 3.X

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 81211ba1f8a83c896b940515ca1da63e09856405e103a870c3d093f07fdd0dab

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3711019/
  
Delivery method
Distributed via web download

Comments