MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b23f88027ee3bf415c59c20b4fc608c858bcf0cdc94ec2434b309352006fb736. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b23f88027ee3bf415c59c20b4fc608c858bcf0cdc94ec2434b309352006fb736
SHA3-384 hash:	dc08cc5ad1c27061a025682bfbe6ab0d5c1d91f47adc5070573f8f735d3b4cfced453b8e65fe6050bf959f5f988520c6
SHA1 hash:	6e590a596e2932536fc1e463495825b595c7026a
MD5 hash:	f199722d6d41828af2b8749aaa4614bb
humanhash:	indigo-maryland-three-glucose
File name:	SoundCloudZapretFix.rar
Download:	download sample
File size:	9'076'387 bytes
First seen:	2026-08-14 16:32:57 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	98304:OGt8dy3X8zlFMvqbMvqjMvqsMvq0MvqAvo7MvqCMvqGMvqEMvqnMvqVMvqIMvqq2:/tQFbjs0TCGEnVIqM5DFTkdhrOX
TLSH	T1F696235487132B99CEB9ADF4A7E23F8F8C44E47469A6380F7144434F05BA8ABD5EE4D0
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	Alex_sev
Tags:	AgentTesla AsyncRAT backdoor rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

116

Origin country :

PL

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/63a05c46-034b-47cd-afc2-a5626bcf50d9/

ClamAV Detected

Detection(s):

SecuriteInfo.com.not-a-virus.HEUR.RiskTool.Multi.WinDivert.gen.25597.12273.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b23f88027ee3bf415c59c20b4fc608c858bcf0cdc94ec2434b309352006fb736

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-08-14T14:44:00Z UTC

Last seen:

2026-08-14T14:57:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b23f88027ee3bf415c59c20b4fc608c858bcf0cdc94ec2434b309352006fb736/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout Rar Archive SOS: 0.91 SOS: 0.92 T1059.001

Link:

https://app.malva.re/file/f199722d6d41828af2b8749aaa4614bb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b23f88027ee3bf415c59c20b4fc608c858bcf0cdc94ec2434b309352006fb736/

ReversingLabs TitaniumCloud ByteCode-MSIL.Backdoor.AsyncRAT

Threat name:

ByteCode-MSIL.Backdoor.AsyncRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-14 16:33:39 UTC

File Type:

Binary (Archive)

Extracted files:

72

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wi7yqat64o7ucxczyifu7rqizbmlz4gnzfhmeq2lgcjveadpw43a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b23f88027ee3bf415c59c20b4fc608c858bcf0cdc94ec2434b309352006fb736