MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9
SHA3-384 hash: bf61bc4b3699322698af6c64652d5846db42869f1ad744e493ba60ebe34a0311b9f3e8d36d070a71fade9a42e2d7d0dc
SHA1 hash: 773b3191112014bcf41fe25d8255344b30bed534
MD5 hash: df1a01bf0f7099c83a3da0bebbb35d6a
humanhash: cup-indigo-oranges-comet
File name:kryo_89925084.zip
Download: download sample
File size:18'378 bytes
First seen:2025-12-11 07:21:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:NSh5uKS9FMpLJZqXvrUWd0N0gWzo85KNqGzoGMol1b:N0SfaXqX+5W0HQGz/l1b
TLSH T1E982D1FA0207E16EFB45933B20D56A47086386265C6DCDC375531DAB5061C89A813F2B
Magika zip
Reporter ShadowOpCode
Tags:HUN xworm zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
44
Origin country :
IT IT
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:d0b7f1e092824081.dat
File size:16'208 bytes
SHA256 hash: dd09d56cd29a6463be2f5e695d557305d11d1363a575000379d32cc1390f476b
MD5 hash: 830d9033f9630e2b1ae68e2e09699813
MIME type:application/octet-stream
File name:0c525a181b1b.tmp
File size:196 bytes
SHA256 hash: 302978fc6e945081a366a87e17033b93308a425fa7ebd5248e4c82491512254f
MD5 hash: d2cb2fb9f7cc21f9b8d896e40bd5672e
MIME type:application/octet-stream
File name:ec5e99d1d416.tmp
File size:136 bytes
SHA256 hash: 1ac26a63044d14222736b945d74fb1074569a2d768f5db4c902dc0ecaedd4ac5
MD5 hash: 55e3a2c82f40a6f1d74125b8d41abc83
MIME type:application/octet-stream
File name:e16ebc4b9e694d6d.txt
File size:3'582 bytes
SHA256 hash: ba3b3e7a2ad13c627ca08d56f3d5b0d301884554509230001c6ae8eaf0237ee1
MD5 hash: 74d0fd12f8fd6a25f260bb3dbb1d9d12
MIME type:text/plain
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e78b4af9-4f37-4317-9049-08d52b6039f3/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693a7128a675b653bd0ffe41
Tags:
n/a
Result
Verdict:
Unknown
File Type:
ZIP File
Link:
https://app.docguard.net/ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9/results/dashboard
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/693a71281eac7b9b76a548df/reports/05890fb2-a886-4926-b9f6-4b14f3996696/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9/results?tab=lookup
Score:
6%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9/
Threat name:
Script.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2025-12-09 21:41:09 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjhcd2kx2rjmh5ctzulcko6mzk3plyzyywh35svacrobbzzg7puq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/251211-pvta8adj81/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution

File information

The table below shows additional information about this malware sample such as delivery method and external references.

XWorm

Batch (bat) bat e5fae433d3965683a2ae5873781e001a9ecd77b69d996223f80ec0e709420631

zip ba4e21e957d452c3f453cd16253bcccab6f5e338c58fbecaa0145c10e726fbe9

(this sample)

  
Dropped by
SHA256 e5fae433d3965683a2ae5873781e001a9ecd77b69d996223f80ec0e709420631
  
Dropped by
MD5 6c0b87153a1b9083a77a848fdebeb4df

Comments