MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fbf0cacb304deffbf2ca3ac61721ebd114aff6aa14800c4e776b182bd7e92ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	9fbf0cacb304deffbf2ca3ac61721ebd114aff6aa14800c4e776b182bd7e92ed
SHA3-384 hash:	88beb6d5ad1f3c691c010cc995939cbc10169c79963e955ff866d12f5f6686ef760a34d8cc7f376c697a6c4d64d662bb
SHA1 hash:	96c5f04a1309934bea36e1320a7372bed7007a50
MD5 hash:	18ad9bc77d4c15d1a9990a731ff6b9cb
humanhash:	black-connecticut-twenty-california
File name:	goxlr-utility-1.3.1.zip
Download:	download sample
File size:	62'743'834 bytes
First seen:	2026-11-14 07:05:42 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1572864:UlKGRmdEJrTpvByFYYOwvQnyJ165N4ecaxcmxKdqEqs4eRarw+9:QRmd4NByFTey/kN4ZG9xZEP4eRj+9
TLSH	T107D733589CD0DAFE509920ED17619CA280B0F02CB85D0E78781EBFF91D5F1B1A61B6ED
Magika	zip
Reporter	w33t

w33t_io

Identified in malicious social engineering campaign.

See more here: https://w33t.io/blog/goxlr-twitch-and-a-very-bad-audio-recommendation

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	goxlr-utility-1.3.1.exe
File size:	99'626'051 bytes
SHA256 hash:	936ad58ce9a24c2630c26b92afe79d6ef504d5b3c815fa5fa159dbc71a1e7321
MD5 hash:	42d54d04d41067549fba652a78d78b62
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/32b06443-6a7b-41f4-ae02-f92dd4fc3eac/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af808760a71acf937da86a2

Tags:

obfuscate shell java sage

Result

Verdict:

Clean

File Type:

PE File

Link:

https://app.docguard.net/9fbf0cacb304deffbf2ca3ac61721ebd114aff6aa14800c4e776b182bd7e92ed/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/9fbf0cacb304deffbf2ca3ac61721ebd114aff6aa14800c4e776b182bd7e92ed

Verdict:

Malicious

File Type:

zip

Link:

https://opentip.kaspersky.com/9fbf0cacb304deffbf2ca3ac61721ebd114aff6aa14800c4e776b182bd7e92ed/results?tab=lookup

Score:

94%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

defense_evasion discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/261114-h98wwsxs2r/

Behaviour

Checks processor information in registry

Kills process with taskkill

Modifies registry key

Runs net.exe

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

Contacts third-party web service commonly abused for C2

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Malware Family:

killproc

Malicious:

True

Tags:

macro-ps debug-check embedded-executable zip obfuscated

Link:

https://intel.virussign.com/intelligence/file/9fbf0cacb304deffbf2ca3ac61721ebd114aff6aa14800c4e776b182bd7e92ed

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/