🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d65192fabdefc204ea73e9c19b22c81af46c9b3946cc2ff4df40d18516f97e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d65192fabdefc204ea73e9c19b22c81af46c9b3946cc2ff4df40d18516f97e2
SHA3-384 hash: d26e48369a21ef69f7a09786078f2793740cabc2cb08d4f730142544e3efb5ac6023f031bf3a0026c94bd1aeca872c78
SHA1 hash: 528038d6c259a5e6d5f64fdb497ec905fb28ba68
MD5 hash: 4f76adbf0d6dbfa223a96e40aa7375fb
humanhash: lemon-fourteen-green-uniform
File name:mbupload-m8tv7yba.bin
Download: download sample
File size:11'227'123 bytes
First seen:2026-10-19 03:08:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:xoslj+RxnaqYfoYhvhVo6PfrlPW2zvT6VpsaurXkJWcaiJ5uQdQnBhv:xflinDUh7o67QaT6vslTkJWlQdQnBB
TLSH T1E2B633ECCA403CCDE8C7BA3D8BE819EAE9D58A378A10D5E6D145A3E0247E1FD2C51457
TrID 66.6% (.XPI) Mozilla Firefox browser extension (8000/1/1)
33.3% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter wristhulk
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
US US
File Archive Information

This file archive contains 16 file(s), sorted by their relevance:

File name:run.bat
File size:626 bytes
SHA256 hash: 8ce38925a1b0bc83fdd791ab1756c1a0b6e689bde80159075c4239c180e00245
MD5 hash: b2f0961d977569aba02fcf2813d107ca
MIME type:text/x-msdos-batch
File name:requirements.txt
File size:86 bytes
SHA256 hash: 31c63891257fb609fb503d09db9f4190ffe240ff1a1e8a730c5d9cdffaffebd9
MD5 hash: 9ea0eb5478b1d12e7e993a1b58564bbb
MIME type:text/plain
File name:install.py
File size:1'974 bytes
SHA256 hash: 96be0ca5a4343f92bd023da48e97d2fcdc0d394089d0dbfeb8118d3bde8ef092
MD5 hash: eeb8a6644ff8a8b747161934e3c5e8f5
MIME type:text/x-python
File name:ui.py
File size:6'121 bytes
SHA256 hash: 251e2b310f7f983866d82fb647d34aa7987541b5848f19d12edaf67893a63b30
MD5 hash: 1ca57bf6bf6e19a3da94bf4627b3688b
MIME type:text/x-python
File name:executor.py
File size:5'126 bytes
SHA256 hash: d35542ebd717a424b049de50148719eee7b5502a54537e05596e0411203daa20
MD5 hash: c36a7a14fdfde78bf4f4dd913d0d4db8
MIME type:text/plain
File name:config.json
File size:322 bytes
SHA256 hash: 488c243d75e03961acbd304fa5ad0ed33f0d559c3977312c6e3d1b6ce5a006cf
MD5 hash: dfdd69ee6629adf03e85a995ec0dee2d
MIME type:application/json
File name:__init__.py
File size:4'805 bytes
SHA256 hash: 67c62fe6837fea900ff542f0c3334e49935c12a9490e33ff75669d268195856e
MD5 hash: 29e6c415f78558365d211fe9b3eaa80a
MIME type:text/plain
File name:main.py
File size:3'854 bytes
SHA256 hash: 85b2ff8aa29fc1408875dbd6176e6fbe7e883cb5ca3174ccf29caef3112d4435
MD5 hash: 4d0846e4efb41d9db5d34afbee76e892
MIME type:text/x-python
File name:settings.py
File size:1'625 bytes
SHA256 hash: 65bb76923e4a8adbbbcbce3914b9fca5af88c75742bff1546257f28c28950cc4
MD5 hash: ab58ab3ae006a0ce33155106bb2f8bab
MIME type:text/x-python
File name:fetcher.py
File size:2'309 bytes
SHA256 hash: faa499949d4479361f27812525b2792a7ec37d4eb0c0c68c2bc34beb3b974191
MD5 hash: 3b27bc693c4908e943d423190e4e9f25
MIME type:text/x-python
File name:about.py
File size:2'823 bytes
SHA256 hash: 2d7cd6b025cf22e37fd1dc0e397ad9604ebc80509b1ba11281a0ea2a7e0b0738
MD5 hash: 0ceb316596836ccb7a648b6c2e2827ad
MIME type:text/x-python
File name:arch.py
File size:2'926 bytes
SHA256 hash: 7b505bc72170887fcf78b05cac0b6e775d8672ab4e00e663e129013f1a7a20c1
MD5 hash: 517075eaa60529b6585c3ac37fb18500
MIME type:text/plain
File name:bot_actions.py
File size:5'308 bytes
SHA256 hash: 8a2f6449d528756cc713ccf91aced7018340d215be450487cc9a1058bea2a498
MD5 hash: b1037e3fc987ee3c5ab8895a843494a4
MIME type:text/x-python
File name:vault.py
File size:4'084 bytes
SHA256 hash: 2d5582d50840a1eb5f4bb4eec6cb5492ffb1918ceba12487eb1d5c302d0633d1
MD5 hash: cf571f2b939808a10ec77657133ae778
MIME type:text/plain
File name:bundle.dat
File size:11'249'149 bytes
SHA256 hash: 85e60fa44f02780b933da5c5a403c28d65d13b9592e6cb987bf56e11f67ba381
MD5 hash: 5fde0ce16bbc83eaabe48b112bf1f6ce
MIME type:application/zip
File name:config.py
File size:1'704 bytes
SHA256 hash: 94446ab2de082059c239498bcd428cb863eb202c94b54fc5416af2952d768ccd
MD5 hash: a14b9fd3659dec0b4338b6105dc42f58
MIME type:text/x-python
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1463ce6f-c4bf-4817-b937-c0eaf887d90b/
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad589ac5a22ac805bd7d029
Tags:
shell sage
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/8d65192fabdefc204ea73e9c19b22c81af46c9b3946cc2ff4df40d18516f97e2
Verdict:
Unknown
File Type:
zip
First seen:
2026-05-01T03:50:00Z UTC
Last seen:
2026-10-19T11:01:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8d65192fabdefc204ea73e9c19b22c81af46c9b3946cc2ff4df40d18516f97e2/results?tab=lookup
Score:
3%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/8d65192fabdefc204ea73e9c19b22c81af46c9b3946cc2ff4df40d18516f97e2
Verdict:
Malware
YARA:
4 match(es)
Tags:
DeObfuscated Executable PDB Path PE (Portable Executable) PE File Layout PowerShell T1027 T1059.001 T1059.005 Zip Archive
Link:
https://app.malva.re/file/4f76adbf0d6dbfa223a96e40aa7375fb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d65192fabdefc204ea73e9c19b22c81af46c9b3946cc2ff4df40d18516f97e2/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-04-26 13:59:57 UTC
File Type:
Binary (Archive)
Extracted files:
1410
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rvsrsl5l336catvhh2obtmrmqgxunsntsrwmf72n6qgrqulps7ra._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/261019-gfwh2afs3z/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8d65192fabdefc204ea73e9c19b22c81af46c9b3946cc2ff4df40d18516f97e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 8d65192fabdefc204ea73e9c19b22c81af46c9b3946cc2ff4df40d18516f97e2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3952221/
  
Delivery method
Distributed via web download

Comments