🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b70b9a0ed88ed9e7f4109fcea28203fa8e7c0bc07fbae1df5f24104395387ed2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b70b9a0ed88ed9e7f4109fcea28203fa8e7c0bc07fbae1df5f24104395387ed2
SHA3-384 hash: c6cc7e457cdbd71e9fc145144deb7937f9e9230f3b7944f469fbc1ccac98126cf35482745de15d7207d7e802272fae8c
SHA1 hash: 9c072d2379a33f76e667a929d10797f907fc0246
MD5 hash: 076dc0654a1e3ba7a07152aaeff7b869
humanhash: equal-juliet-seven-cold
File name:build.rar
Download: download sample
File size:16'146'939 bytes
First seen:2025-10-08 02:12:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 393216:6h2syPtG7iamWMDHI9Z+B4BFHh2ikVrRcXQkQAUaDhT9tZXc/Ew7:6N2GmWMOMB4ThdCMQgUIdA7
TLSH T109F63310C91E420ADDD3B3F9A034CF02E33D8F99F506D56B59DA9BCA2E5D0A2472F856
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter ertutioabcd
Tags:Python Ransomware rar WannaCry

Intelligence

File Origin
# of uploads :
1
# of downloads :
506
Origin country :
HK HK
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e5c8a57f305fa2545d77bf
Tags:
n/a
Verdict:
Unknown
Threat level:
n/a  -.1.0/10
Confidence:
100%
Tags:
adaptive-context anti-vm expired-cert microsoft_visual_cc signed
Link:
https://www.filescan.io/uploads/68e5c89bd4a0085473c37b19/reports/96dd607c-5e5f-4c0f-9627-a51180b83bcf/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b70b9a0ed88ed9e7f4109fcea28203fa8e7c0bc07fbae1df5f24104395387ed2
Verdict:
Unknown
File Type:
rar
Link:
https://opentip.kaspersky.com/b70b9a0ed88ed9e7f4109fcea28203fa8e7c0bc07fbae1df5f24104395387ed2/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b70b9a0ed88ed9e7f4109fcea28203fa8e7c0bc07fbae1df5f24104395387ed2/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/b70b9a0ed88ed9e7f4109fcea28203fa8e7c0bc07fbae1df5f24104395387ed2
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-08 01:51:42 UTC
File Type:
Binary (Archive)
Extracted files:
1467
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w4fzudwyr3m6p5aqt7hkfaqd7khhyc6ap65odx27eqiehfjyp3ja._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251008-f4sxdasvcx/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b70b9a0ed88ed9e7f4109fcea28203fa8e7c0bc07fbae1df5f24104395387ed2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

rar b70b9a0ed88ed9e7f4109fcea28203fa8e7c0bc07fbae1df5f24104395387ed2

(this sample)

anyrun
any.run
https://app.any.run/tasks/787a5810-14e7-44ac-8346-09357e02df1f
  
Delivery method
Distributed via web download

Comments