MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a71afc5435223148f86c0b45c2fe871e3bc3ccbf71968ececb8dd41cb11c3a3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a71afc5435223148f86c0b45c2fe871e3bc3ccbf71968ececb8dd41cb11c3a3a
SHA3-384 hash:	45070334049b52fff73f56ecf825a626e5ce2d81b529e3104fe76cb42976811f6689794155c39330c50fd725c123810a
SHA1 hash:	5cd3ddcc59f563232d690a1979bd6017e3aa34e9
MD5 hash:	e17cc5cff576ebd33129850380f289da
humanhash:	lithium-magazine-connecticut-cat
File name:	Xeno-v1.3.65.zip
Download:	download sample
Signature	RustyStealer Alert Create hunting rule
File size:	91'259'431 bytes
First seen:	2026-11-03 23:06:13 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1572864:1Pvr5dXYMH7R1v+n9qnRiYrdWff/vPHYwatts0W4l1T5gutI1K6XaNmx8mFuuUCP:1Pvr5dXpl1v+9qnrrc0LsRmuEWfaQx8O
TLSH	T1ED183327F143B12294A44CC9144DFF6D79B2227F329C8BE46845934EFED2D18A2B7366
Magika	zip
Reporter	josie
Tags:	RustyStealer zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

89

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Xeno-v1.3.65.exe
File size:	91'456'763 bytes
SHA256 hash:	49eb00e255cd7c55882feab1e80a9356d9e373bdbe566e77f5c686f75dbf9b0d
MD5 hash:	3f777d8dace98e425ffd8e29092e7525
MIME type:	application/x-dosexec
Signature	RustyStealer

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/059044e9-1ac5-4219-b6fc-cacc9ce94a6e/

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aea69033970fcef1e4ae796

Tags:

injection autorun extens crypt

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/a71afc5435223148f86c0b45c2fe871e3bc3ccbf71968ececb8dd41cb11c3a3a/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug crypto fingerprint installer installer installer-heuristic microsoft_visual_cc overlay packed packed reconnaissance sfx

Link:

https://www.filescan.io/uploads/6aea68fc5396259bc23ac0ca/reports/3f1ef1c0-6f48-4262-bd6b-7f61c025d9bb/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/a71afc5435223148f86c0b45c2fe871e3bc3ccbf71968ececb8dd41cb11c3a3a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-11-03T21:02:00Z UTC

Last seen:

2026-11-04T09:33:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a71afc5435223148f86c0b45c2fe871e3bc3ccbf71968ececb8dd41cb11c3a3a/results?tab=lookup

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/a71afc5435223148f86c0b45c2fe871e3bc3ccbf71968ececb8dd41cb11c3a3a

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Convagent

Threat name:

Win32.Trojan.Convagent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-03 23:07:27 UTC

File Type:

Binary (Archive)

Extracted files:

8

AV detection:

18 of 38 (47.37%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u4npyvbveiyur6dmbnc4f7uhdy54htf7ogli5twlrxkbzmi4hi5a._file

VirusSign convagent

Malware Family:

convagent

Alert

Create hunting rule

Malicious:

True

Tags:

zip detect-debug-environment contains-pe long-sleeps

Link:

https://intel.virussign.com/intelligence/file/a71afc5435223148f86c0b45c2fe871e3bc3ccbf71968ececb8dd41cb11c3a3a

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.