MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8dd8dbcf94b3397802b1ee69a9e91549cf31cbcb56b9471458706b275d6d176a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8dd8dbcf94b3397802b1ee69a9e91549cf31cbcb56b9471458706b275d6d176a
SHA3-384 hash:	5d1349e3e86eeb6b34e27240d7403436b93917dadb029e169af3fac5f235342f5b27eba2f216361a2a91e09fb0165855
SHA1 hash:	988086b1ff25138e90a911eed07b77b9ea3cc592
MD5 hash:	f721f6908552ee2e17d9d8c93d8ac062
humanhash:	coffee-cola-fanta-cold
File name:	nOrden_de_compr.bz2
Download:	download sample
Signature	DarkTortilla Alert Create hunting rule
File size:	745'921 bytes
First seen:	2026-02-28 15:00:21 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:Gp8GaQMfaL83vWj779MO0cexkMpQVPebOTUAzv3vcuCgF37t2IOEC7OsmI3TEY0T:G+GQiKQuO0ce7EPeCTUAQuCk37Fl+3T6
TLSH	T12EF42387EADB059FBD3AA4795CBE30E5059C06ED1105DEB1B6C0E00BB7DAE93842C856
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	FXOLabs
Tags:	DarkTortilla rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

63

Origin country :

BR

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ffa25816-3fa6-4681-b60b-779530a29ddc/

ClamAV Detected

Detection(s):

Porcupine.MSIL.Kryptik.APQT.498065.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a30340c950ab5d9ab2898f

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 blustealer lolbin obfuscated obfuscated tracker vbnet

Link:

https://www.filescan.io/uploads/69a30311d967dbda74ef6a48/reports/cff6d4dc-8a19-4293-96fc-c0ca04a860dd/overview

Hybrid Analysis Trojan.Agent

Verdict:

Malicious

Labled as:

Trojan.Agent

Link:

https://www.hybrid-analysis.com/sample/8dd8dbcf94b3397802b1ee69a9e91549cf31cbcb56b9471458706b275d6d176a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

Link:

https://opentip.kaspersky.com/8dd8dbcf94b3397802b1ee69a9e91549cf31cbcb56b9471458706b275d6d176a/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8dd8dbcf94b3397802b1ee69a9e91549cf31cbcb56b9471458706b275d6d176a/

Neiki Family.DARKCLOUD

Verdict:

Malicious

Threat:

Family.DARKCLOUD

Link:

https://tip.neiki.dev/file/8dd8dbcf94b3397802b1ee69a9e91549cf31cbcb56b9471458706b275d6d176a

ReversingLabs TitaniumCloud Win32.Trojan.Suschil

Threat name:

Win32.Trojan.Suschil

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-27 22:43:00 UTC

File Type:

Binary (Archive)

Extracted files:

43

AV detection:

20 of 36 (55.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rxmnxt4uwm4xqavr5zu2t2ivjhhtds6lk24uofcyobvsoxlnc5va._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery persistence

Link:

https://tria.ge/reports/260228-xec83acv9b/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of SetThreadContext

Adds Run key to start application

.NET Reactor proctector

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8dd8dbcf94b3397802b1ee69a9e91549cf31cbcb56b9471458706b275d6d176a