MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81a37e3d7ff0088dfc2695a0cf31eb8eb5d410c61b3e4bbafdc645c95d5d4253. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	81a37e3d7ff0088dfc2695a0cf31eb8eb5d410c61b3e4bbafdc645c95d5d4253
SHA3-384 hash:	6097cb7cb18a1816ae14d20f4be051a398eff7c1cf28b83f30a83adc6f2faea827e9a690e6f71ba578bf105605a4196a
SHA1 hash:	84ebd410a2be38b44f83862aabb4b2a58c31277d
MD5 hash:	384f2ff9db03aa4482398693973d0f9f
humanhash:	johnny-lactose-india-oranges
File name:	Hardware Wallet Backdoor.rar
Download:	download sample
File size:	7'032'670 bytes
First seen:	2026-06-25 10:09:22 UTC
Last seen:	Never
File type:	rar
MIME type:	application/octet-stream
ssdeep	196608:Yyiaqz3CvFyQSaD5JmqueZH9CEzIWD5ESg:Yyia4yh5prrZg
TLSH	T17366337AAF8122022F995EB28B59E6F355F408C758E386C358B77C3318D49156FEBC90
Magika	rar
Reporter	smica83
Tags:	Crafted8088 rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

43

Origin country :

HU

File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

Potential files of interest 2

File name:	Affected_Batch.png:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_Microsoft Store.lnk
File size:	2'942 bytes
SHA256 hash:	e175abb46558219cc9d41f6890fe90469d62cbaaa4cfa45fc2dd3b231f860747
MD5 hash:	cf8e97b9877448c992017302a2ac472b
MIME type:	application/octet-stream

File name:	Tampered_Chip.png:.._.._A_Final_Message_from_Wei_Lin_before_he_went_dark,txt.lnk
File size:	1'712 bytes
SHA256 hash:	5bc17760ac840cc55b6625fa215f508950179ab7e1697b8054395aeba6639769
MD5 hash:	e77b64bbcb1bd3dff9179a9459c081b5
MIME type:	application/octet-stream

Other files 3

File name:	Tampered_Chip.png
File size:	2'626'516 bytes
SHA256 hash:	d90aa9f7c0e8eab80ab9e4f6c4784f5ad3cb32e321a40ea92781376a87370a4b
MD5 hash:	9f50bb09dd2812afd41b49588cda497d
MIME type:	image/png

File name:	Whistleblower_Note.png
File size:	2'181'069 bytes
SHA256 hash:	17b9253989045a9ea70de99f2f5d78f8343fbf77f745f60177dfee104b3dc6e1
MD5 hash:	c36dc878107209fb112b3162a2d2fc6e
MIME type:	image/png

File name:	Affected_Batch.png
File size:	2'242'083 bytes
SHA256 hash:	d16c080dc244c07f859385f9c0da63c8d1a1b1d05638e4b02a226fd305616882
MD5 hash:	a1850d2a7fd0ca44a77c257296255092
MIME type:	image/png

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

TwinWave.EvilRAR.GhettoSuperstream.20241120.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3d074386bc95245bf9628a

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 cmd evasive lolbin powershell wsreset

Link:

https://www.filescan.io/uploads/6a3d06f89799578a6c4b4bf7/reports/2b7855b1-be2d-486b-85c7-82853f075872/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/81a37e3d7ff0088dfc2695a0cf31eb8eb5d410c61b3e4bbafdc645c95d5d4253

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unknown

First seen:

2026-06-25T09:02:00Z UTC

Last seen:

2026-06-25T09:07:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/81a37e3d7ff0088dfc2695a0cf31eb8eb5d410c61b3e4bbafdc645c95d5d4253/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/81a37e3d7ff0088dfc2695a0cf31eb8eb5d410c61b3e4bbafdc645c95d5d4253/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-17 16:04:55 UTC

File Type:

Binary

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qgrx4pl76aei37bgswqm6mplr225ieggdm7exox5yzc4sxk5ijjq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/260625-mt4z8aaz6x/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/81a37e3d7ff0088dfc2695a0cf31eb8eb5d410c61b3e4bbafdc645c95d5d4253