MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5a9f57f709c8361366bb4b03633e0859749056bac916dc5907c01b00e78b8b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b5a9f57f709c8361366bb4b03633e0859749056bac916dc5907c01b00e78b8b2
SHA3-384 hash:	d938e5fcd47f63087cdced7a02bcb137ea0e87f8bbfaba6b0ee6bdb6d86172234ff9be54509040243b02fd3c02589c67
SHA1 hash:	16003a057cc5b62aaba78dba156ed39097cf0c78
MD5 hash:	08f0dbb5d881cd3258a7abb14835fceb
humanhash:	neptune-echo-charlie-carolina
File name:	烟雨江南.rar
Download:	download sample
File size:	4'028'749 bytes
First seen:	2026-03-02 09:24:14 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	98304:Dgyg/dnjml2wtVtSeLpBZwDVSSMvRyhP4bkOll/FK2KFprOZm5a:DgymjmlXVtSelBq4b585Os5a
TLSH	T1051633A4F811576710BA379A782F16DE48E31F722FF167639298C39A18F87424F1436E
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	juroots
Tags:	rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

53

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Potential files of interest 1

File name:	烟雨江南.exe
File size:	4'038'336 bytes
SHA256 hash:	e7ba05a22decbb99788a3008f2a97c0b4a16ad3fa2f975e919f14c7cadf15d26
MD5 hash:	ae1d7de8ac115c2aeb4156ba444f2f4d
MIME type:	application/x-dosexec

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/fd289f7a-21a8-4ded-8184-7e6462c3e2fa/

ClamAV Detected

Detection(s):

Win.Malware.Gamehack-10033441-0

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

N/A%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a55766e1f958bf66829275

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

borland_delphi evasive installer-heuristic obfuscated overlay packed packed packed stealer vmprotect

Link:

https://www.filescan.io/uploads/69a5575bcd25bfe1dfdde689/reports/fc2e9f4f-d26f-4a42-806e-8b80581b087e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b5a9f57f709c8361366bb4b03633e0859749056bac916dc5907c01b00e78b8b2

InQuest

Result

Gathering data

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b5a9f57f709c8361366bb4b03633e0859749056bac916dc5907c01b00e78b8b2/

ReversingLabs TitaniumCloud Win32.Malware.Generic

Threat name:

Win32.Malware.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-03-02 09:25:44 UTC

File Type:

Binary (Archive)

Extracted files:

3

AV detection:

11 of 36 (30.56%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wwu7k73qtsbwcntlwsydmm7aqwlusbllvsiw3rmqpqa3adtyxcza._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery upx

Link:

https://tria.ge/reports/260302-ltmv9sg19e/

Behaviour

Checks processor information in registry

Enumerates system info in registry

System Location Discovery: System Language Discovery

UPX packed file

Enumerates connected drives

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b5a9f57f709c8361366bb4b03633e0859749056bac916dc5907c01b00e78b8b2