MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a25aaf306e8ea9cab97a6999b57259e9860e56254bfa560893b834b8559603ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	a25aaf306e8ea9cab97a6999b57259e9860e56254bfa560893b834b8559603ac
SHA3-384 hash:	cffd4bfbc1dd4d58ef813944e35c8e6225c89f5430d00748b82a11f7e23b6983fa503a003b563c49efe968e13f6caecc
SHA1 hash:	5fe428f7486f0c1292a97b650daded4444c47e8e
MD5 hash:	96ad300ef40b44f1ce4635626d6af4a4
humanhash:	two-fillet-berlin-snake
File name:	NaxeraGameSetup.7z
Download:	download sample
File size:	25'003'401 bytes
First seen:	2025-12-30 22:11:27 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	393216:ynEcFfrf6APvAffMT1HG4ZwcGkF1YUFZwZwbSgR8ChamMI5VN8WKs71hG0+XNU9y:CBSA2ETA4ZwvkFNFKKu6F+4VWWR1hz+9
TLSH	T14247331D54B6028BAF220F59194F51EC35C1616B893FDCD5D3F3CAA23A901A2BD5ECE8
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	data__
Tags:	7z file-pumped nodejs stealer

data__

(Sorry for compressed archive, malwarebazar gives me an error when uploading the exe, presumably from too big file size)

Distributed via compromised discord accounts, advertised as a "game", attacker hijacks various accounts of the victim (including their discord to further spread the malware), then attempts to extort the victim with the information in exchange for a crypto ransom.

Link the attacker sends : https://naxeragame.blogspot.com/2025/10/game.html

Binary is packed javascript with nodejs runtime, seems to be compiled to bytecode, doesn't contain any source from what i can find, can't find any actual working nodejs unpackers.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	NaxeraGameSetup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	130'314'022 bytes
SHA256 hash:	c8a2a95a26c5037e015e18c10395f8918b9a18f6300d3b1999c64407aefa15c3
MD5 hash:	f1e27b98db86eab552e33bc1fae00f3b
De-pumped file size:	57'404'416 bytes (Vs. original size of 130'314'022 bytes)
De-pumped SHA256 hash:	3ce1994752a17d5b63194fe89e097f63338f85900b53833b74fc68215166a6b1
De-pumped MD5 hash:	8a651acb7b2be232ce11035fd4d1180c
MIME type:	application/x-dosexec

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69544e577468b4bd1c8ef9c6

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

microsoft_visual_cc overlay packed pkg

Link:

https://www.filescan.io/uploads/69544e3e2fb7bb52ca82a6ff/reports/9e02393a-7048-4ef0-aea2-77fdbf20e7f3/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a25aaf306e8ea9cab97a6999b57259e9860e56254bfa560893b834b8559603ac

Result

Gathering data

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/a25aaf306e8ea9cab97a6999b57259e9860e56254bfa560893b834b8559603ac/results?tab=lookup

Score:

96%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/