MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 937e4f8133d72d80f8cb9977c05a744bf7ef70823cd3dde7a4a6e376a0946c6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CarnavalHeist

Vendor detections: 7

Intelligence 7 IOCs YARA 8 File information Comments

SHA256 hash:	937e4f8133d72d80f8cb9977c05a744bf7ef70823cd3dde7a4a6e376a0946c6c
SHA3-384 hash:	249d8e2e00272345c0e058a4c5a1d463e4fd6f8e0e142c28ddef0952afc2ad987b894361417298c04d42b22da0e23550
SHA1 hash:	2b26a96ca89615d86ee8f4afadb128e35409e0d4
MD5 hash:	9cbdf0c017184318fae993173d0eb8c1
humanhash:	jig-leopard-enemy-oklahoma
File name:	ztrwpdxy.zip
Download:	download sample
Signature	CarnavalHeist Create hunting rule
File size:	2'295 bytes
First seen:	2026-07-30 17:50:43 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	48:9U1b0MDGOtY4E0s1/GnlpaslwsiVXb+YWYDCHunZDhc7KN:a1b9zG0sGuDnVXbAHGZKeN
TLSH	T1AE412BA9E5CBFED0DE21AA7176D4888C2E34D22152D4F450D3791304022E6F8EE03FD2
Magika	zip
Reporter	johnk3r
Tags:	CarnavalHeist centrallxml-co contabilidadehpr-vip Downloader j86ab5b0c9792169c604a1cc-brazilsouth-cloudapp-azure-com zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	ztrwpdxy.bat
File size:	3'817 bytes
SHA256 hash:	b78cdf3ff3def0a9800ff193bb0d4928072e1296c7801fc095fc9e69442a333c
MD5 hash:	426477871ea1c1475de3ecadc3f6fb9d
MIME type:	text/plain
Signature	CarnavalHeist

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b4453946-63c0-48d8-9f45-1ac13949df2e/

Result

Verdict:

Suspicious

File Type:

Bat File

Link:

https://app.docguard.net/937e4f8133d72d80f8cb9977c05a744bf7ef70823cd3dde7a4a6e376a0946c6c/results/dashboard

Payload URLs

URL

File name

https://www.python.org/ftp/python/3.13.0/python-3.13.0-embed-win32.zip

Bat File

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

cmd lolbin obfuscated opendir powershell

Link:

https://www.filescan.io/uploads/6a6b8f2055c3244ec0d554fa/reports/f1c1e7d1-cdbf-464d-81bb-55df9f686f29/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/937e4f8133d72d80f8cb9977c05a744bf7ef70823cd3dde7a4a6e376a0946c6c

Score:

99%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260730-xp2z6syvex/

Behaviour

Checks processor information in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/937e4f8133d72d80f8cb9977c05a744bf7ef70823cd3dde7a4a6e376a0946c6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Base64_decoding Create hunting rule
Author:	iam-py-test
Description:	Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	obfuscated_BAT Create hunting rule
Author:	@warz_s
Description:	Identifies obfuscated BAT files
Reference:	https://github.com/secwarz/YaraRules

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)