MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0c718a50d939a77e4d26d71f0f8e92eb6ddf9d20e89e3666cff9ed7a4b58819. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a0c718a50d939a77e4d26d71f0f8e92eb6ddf9d20e89e3666cff9ed7a4b58819
SHA3-384 hash:	6de6f1f01085f408a087370987480fffb5e4e1c334a3866f246b6e4c8164e8266bcbedb40ee39874f60fad2f3bcaead2
SHA1 hash:	38b1370ecaf5216f133f9da60c748162832976f4
MD5 hash:	e4e6c15fdcc8e854ce55805de1d195e0
humanhash:	oven-uncle-fanta-harry
File name:	backpack-1.21.1.exe
Download:	download sample
File size:	90'391'481 bytes
First seen:	2026-10-29 18:03:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	b34f154ec913d2d2c435cbd644e91687 (594 x GuLoader, 131 x RemcosRAT, 86 x EpsilonStealer)
ssdeep	1572864:Z4gPXMoKTsFNyB04Xx26zVvncnFVHrFvE7D5N6YGiIC9GZLoe4IE7qq/8y0CPUDN:Z4Ac/sFjix2IcnwrIC9G14Ia2EPQZGU7
TLSH	T1CE1833ACE5417C8FD451EBBF42AD502AAFB46FE04E3D764D5E60A83F268CF0D01911A6
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	0c89001130300180 (3 x NovaShadowStealer)
Reporter	Miaoumap24
Tags:	exe infostealer minecraft

Miaoumap24

This program is a malicious executable in a Minecraft backpack mod. Upon execution, it requests administrator privileges, exfiltrates sensitive user information, and subsequently shuts down the host computer.

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

396

Origin country :

FR

Vendor Threat Intelligence

ACCE NSIS_Installer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9aab0e2f-d5ad-4e29-a229-267e8f5a3bca/

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae38a97b121dd519dcea137

Tags:

extens shell sage

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a0c718a50d939a77e4d26d71f0f8e92eb6ddf9d20e89e3666cff9ed7a4b58819

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-27T13:26:00Z UTC

Last seen:

2026-10-30T17:35:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-PSW.Win32.Greedy.gen HEUR:Trojan-PSW.JS.Greedy.gen HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/a0c718a50d939a77e4d26d71f0f8e92eb6ddf9d20e89e3666cff9ed7a4b58819/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1994847

Signature

Antivirus detection for dropped file

Creates autostart registry keys with suspicious names

Joe Sandbox ML detected suspicious sample

Potential Privilege Escalation using Task Scheduler highest RunLevel

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal communication platform credentials (via file / registry access)

Unusual module load detection (module proxying)

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

88%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/a0c718a50d939a77e4d26d71f0f8e92eb6ddf9d20e89e3666cff9ed7a4b58819

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uddrrjinsonhpzgsnvy7b6hjf23n36osb2e6gztm76pnpjfvramq._file

Threatray NOVABLIGHT

Verdict:

malicious

Label(s):

NOVABLIGHT

Alert

Create hunting rule

Link:

https://reports.threatray.com/fe63a464-ab55-4c05-be56-b31c63146c9f

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution spyware stealer

Link:

https://tria.ge/reports/261029-wm78qs118m/

Behaviour

Checks processor information in registry

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

VMRay NovaShadowStealer

Malware family:

NovaShadowStealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a0c718a50d93/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.