MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa3ca3fd64cee897dd198d9d67c46e1ff183338c27bb17ad746dafdcde6d9598. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa3ca3fd64cee897dd198d9d67c46e1ff183338c27bb17ad746dafdcde6d9598
SHA3-384 hash: 5730f69efcbd57306e72c28b1ffdd7c9c3bba4c8354a61b89b169088faebadab23b6912ecc68b9965902f4f9998b1f59
SHA1 hash: a7046427a84fee2c8376bdcfa80a01f8eeee9982
MD5 hash: 4550764fa8eac6faffc829398ac8a5a7
humanhash: butter-apart-venus-steak
File name:SpectraMenu.zip
Download: download sample
File size:41'715'070 bytes
First seen:2026-04-24 14:51:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 786432:XH3E9BB6zEktoXyAnkU+LZSjgoef22qR31xQ+6NpUGyxEjEhaoO2xxXXuRC:XH3k0oXPnkjNoefo3/2cGyxESO23nuY
TLSH T1929733B1C471019FEC7FB736D4B4590887B6619E2EB5CE2BB61106A809E37F186FD806
Magika zip
Reporter burger
Tags:stealer zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
DE DE
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:SpectraMenu.exe
File size:117'468'672 bytes
SHA256 hash: 580f606bb71709f52103be1b381abff8227df456c4f4cf12c44ef7f407d48ec6
MD5 hash: 0c8ef6c108347798ad60b187db7a2730
MIME type:application/x-dosexec
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a29c87de-1e89-4cbd-a0d8-2c172a07b58a/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69eb839351cce3ff702f90e5
Tags:
obfuscate shell sage
Result
Verdict:
Malicious
File Type:
ZIP File - Malicious
Link:
https://app.docguard.net/aa3ca3fd64cee897dd198d9d67c46e1ff183338c27bb17ad746dafdcde6d9598/results/dashboard
Behaviour
SuspiciousEmbeddedObjects detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto fingerprint obfuscated overlay packed rust
Link:
https://www.filescan.io/uploads/69eb837581aa9ec3bc24ac57/reports/4e4d50c5-e66a-44d9-8934-0061f66cb162/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/aa3ca3fd64cee897dd198d9d67c46e1ff183338c27bb17ad746dafdcde6d9598
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/aa3ca3fd64cee897dd198d9d67c46e1ff183338c27bb17ad746dafdcde6d9598
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/aa3ca3fd64cee897dd198d9d67c46e1ff183338c27bb17ad746dafdcde6d9598/results?tab=lookup
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/aa3ca3fd64cee897dd198d9d67c46e1ff183338c27bb17ad746dafdcde6d9598
Gathering data
Threat name:
Win64.Malware.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-04-24 14:52:47 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
3 of 37 (8.11%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vi6kh7lez3ujpxizrwowprdod7yygm4me65rpllunwx5zxtnswma._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/260424-vyy9jafz4m/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa3ca3fd64cee897dd198d9d67c46e1ff183338c27bb17ad746dafdcde6d9598

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments