MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95474a0563fffacc71a71caaecb47538194e596bf04c71d7ed18805d9d3c315e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	95474a0563fffacc71a71caaecb47538194e596bf04c71d7ed18805d9d3c315e
SHA3-384 hash:	7bf1123fa01a0263d29ba40cdf16109cbe22c77d5a23fc11bfd855ad998c77ed4aaddc79bec3d4f4bd91653e811d6633
SHA1 hash:	26fd83d64a468bb4d389b8b1d7889365dd45d179
MD5 hash:	9d7af9d130ddd180f0cfd5b63669d547
humanhash:	earth-lake-magazine-undress
File name:	o8gday.rar
Download:	download sample
File size:	3'499'817 bytes
First seen:	2026-06-16 10:44:09 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	49152:2Dr+rqQqqpwm/2d4IwNHxH+8Lz0Ls8UMMAjFC7co0Rw/MCYHNMK3W2hgJLL792nE:AhQqqAwZxH+rsvcY7IKi+iW2he2XxVKN
TLSH	T1E4F5334DC64416A1E511AE7F72DF835BF63AB4EF4C00893510B65A3B9AF1E8C460BB72
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	smica83
Tags:	rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

76

Origin country :

HU

File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

Potential files of interest 5

File name:	Instagram_My_Life5.jpg.lnk
File size:	426'391 bytes
SHA256 hash:	ff9fc67f0857b090471cf81ace69843fbf4d6cc8a7ee9b6928e3c46428fca8f9
MD5 hash:	750d94ffb6e24d14ca293674b764e603
MIME type:	application/octet-stream

File name:	Instagram_My_Life2.jpg.lnk
File size:	356'835 bytes
SHA256 hash:	4ab376542deaf25b4d3e4ce84e44640dccb9358978e70da8e0dea6c93e8b12eb
MD5 hash:	f5ce7ee436f7a06ac266d784d5120ea0
MIME type:	application/octet-stream

File name:	Instagram_My_Life4.png.lnk
File size:	3'315'763 bytes
SHA256 hash:	85515d5ea0afa7ad00fefef81ab48e26e028487aea1eb084c176275301f16c37
MD5 hash:	91f1b5e2433dfe982ce16b65372e067c
MIME type:	application/octet-stream

File name:	Instagram_My_Life1.webp.lnk
File size:	88'459 bytes
SHA256 hash:	7e5f73108ec7be17defc7d27a6757d5c69ad997fa38480d5a404c1b1e9ab0ada
MD5 hash:	2791e767560ef973256ca449ba2c0e7b
MIME type:	application/octet-stream

File name:	Instagram_My_Life3.jpg.lnk
File size:	596'577 bytes
SHA256 hash:	466d1fe10dd722b5485b19a71ca0f9cd9f973b3f93749d981b1bf073169fe6f0
MD5 hash:	78016c160d1d47a4894e6b5fce27c083
MIME type:	application/octet-stream

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5a46872d-05a3-4705-861e-2c2fcc16a9e7/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Lnk_Rar_1.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Rar_fs852.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30517.LnkHeur.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30537.LnkHeur.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL

Alert

Create hunting rule

Legacy.Trojan.Agent-1388773

Alert

Create hunting rule

Sanesecurity.Foxhole.Rar_jpg.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Rar_png.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a31290c54a045c340899795

Tags:

infosteal shellcode virus agent

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 encrypted evasive masquerade powershell

Link:

https://www.filescan.io/uploads/6a312908bf16337e43c8d51c/reports/fd6635d6-b867-4c44-b70b-b4ed62bf690f/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/95474a0563fffacc71a71caaecb47538194e596bf04c71d7ed18805d9d3c315e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-13T19:04:00Z UTC

Last seen:

2026-06-13T22:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/95474a0563fffacc71a71caaecb47538194e596bf04c71d7ed18805d9d3c315e/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/95474a0563fffacc71a71caaecb47538194e596bf04c71d7ed18805d9d3c315e/

ReversingLabs TitaniumCloud Win32.Trojan.Suschil

Threat name:

Win32.Trojan.Suschil

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-13 08:53:51 UTC

File Type:

Binary (Archive)

Extracted files:

10

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=svduubld775my4nhdsvozndvhamu4wll6bghdv7ndcaf3hj4gfpa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260616-m94dmaay6q/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Checks computer location settings

Deletes itself

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Malware Config

Dropper Extraction:

http://ryo.gamer.free/mort.php

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/95474a0563fffacc71a71caaecb47538194e596bf04c71d7ed18805d9d3c315e