MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b87bb3b61bc774d9906711ed6f0f85764ed1dbccd8be19bc36a9229b47c4dbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 3

Intelligence 3 IOCs YARA 12 File information Comments

SHA256 hash:	8b87bb3b61bc774d9906711ed6f0f85764ed1dbccd8be19bc36a9229b47c4dbc
SHA3-384 hash:	9ee19e8785ae2c4689d8b344b91ea093c55e2a8c88693f5c2046954201713f05571bd0628b64044bac75b2deee9462b7
SHA1 hash:	4b64b03063fb6b2b9dbdf1d946f3876bbe04ff19
MD5 hash:	ef42f456798492094dcc0e743105d114
humanhash:	johnny-lima-berlin-comet
File name:	Setup_File_30.723.8031.zip
Download:	download sample
File size:	43'240'069 bytes
First seen:	2026-05-25 23:50:07 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: 2026
ssdeep	786432:FCUClfqWX381vozdr+RozKp2qgs3JkuNU9T/nAKuOXoFXgn6UBBrxzpsQqg+Xm:FmCv8dr+8KhNU9T/AKnXoFX+6ABrxzNJ
TLSH	T1A59733511EE0B71BCF5B63C3AAD9B4A40887A32C7EAC7320CC14A44559E98DFF5A171B
Magika	zip
Reporter	aachum
Tags:	akmuniverstall-top file-pumped OnyxC2 pw-2026 zip

iamaachum

https://dnssearcheer.online/gt/

OnyxC2 C2: https://akmuniverstall.top/backend/api/app.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: 2026

This file archive contains 2 file(s), sorted by their relevance:

File name:	borlndmm.dll
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	133'297'536 bytes
SHA256 hash:	d89bb4b23a67814ef511e4e9dda7ad36fa519a322fa7c25ea451c7dd7ef61e54
MD5 hash:	16acfafdfaebf23088f7a76c24ace6c4
De-pumped file size:	55'297'536 bytes (Vs. original size of 133'297'536 bytes)
De-pumped SHA256 hash:	aa0a144620467804767811f4db8a020743fd89a75d86c94342695c0d99414226
De-pumped MD5 hash:	a18fe03c22b6b0727a170c55d8a4a4cc
MIME type:	application/x-dosexec

File name:	Setup_File_27.430.4673.exe
File size:	3'567'528 bytes
SHA256 hash:	41999a3d0da035ff8068905c90235ea50121329cb0661e38d745974ebf5e3ae2
MD5 hash:	cf64c7e2e3897ae5fce3d5414e3d1d27
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/deb19cec-1a10-4427-b84b-dcae04e65efc/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a14e0605b1db29f5a47d555

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8b87bb3b61bc774d9906711ed6f0f85764ed1dbccd8be19bc36a9229b47c4dbc

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/8b87bb3b61bc774d9906711ed6f0f85764ed1dbccd8be19bc36a9229b47c4dbc/results?tab=lookup

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rod3wo3bxr3u3gigoepnn4hyk5so2hn4zwf6dg6dnkjctnd4jw6a._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/260526-ezqqsabx2j/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Any_SU_Domain Create hunting rule
Author:	you
Description:	Detect any reference to .su domains or subdomains

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_all_IPv6_variants Create hunting rule
Author:	Bierchermuesli
Description:	Generic IPv6 catcher

Rule name:	goLangMatch3 Create hunting rule

Rule name:	goLangMatch4 Create hunting rule

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/