MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c22808c338b7dd266338752fd419f82d8761e9920dc99467ca2bf9683948ed96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GoToResolve


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c22808c338b7dd266338752fd419f82d8761e9920dc99467ca2bf9683948ed96
SHA3-384 hash: 0668e63a01e6625818e1cbba0c1da9b0fcbbc3728c2ddfce58efdaa3153783fe764b7760eb5ea68b8aac5be7675f05c1
SHA1 hash: fcf2397a8f8218eec1721fad0947ca35efdd9b3f
MD5 hash: 38bb81c81be570d40adefd736dc2512e
humanhash: golf-bluebird-oxygen-lion
File name:ZoomInstallerUpdate8.3.zip
Download: download sample
Signature GoToResolve
Create hunting rule
File size:1'809 bytes
First seen:2026-03-10 09:56:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 48:9dLMEurU3hGtH+DSsTAjmiDsQtqyg8WQYGvxaQa8bvh5Xkf8pZLMy:xOUOH+uldsQtPgA5aQa8hKyh
TLSH T15631E6E9DA70C1B0F66D113CA90389C38DC40745960AD2A2BBB17F97531022ACBBE2E1
Magika zip
Reporter jeroengui
Tags:vbs zip Zoom


Avatar
JeroenGui
Zoom malware

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
BE BE
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:ZoomInstallerUpdate8.3.vbs
File size:4'147 bytes
SHA256 hash: 8259aa849ddd7f1dbe5d4074ae7c6b23a202732a7b3e346629201b2073c63f69
MD5 hash: 65dbc1c8e5bb5d878d9b2aaf766cdfdf
MIME type:text/plain
Signature GoToResolve
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5d680c1b-e937-48cd-a1c7-b6ba76793107/
Detection(s):
Sanesecurity.Foxhole.JS_Zip_1v.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Downloader-30.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.VBS-in-ZIP.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69afeafde41a5a099931bab3
Tags:
trojandownloader virus blic
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c22808c338b7dd266338752fd419f82d8761e9920dc99467ca2bf9683948ed96
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c22808c338b7dd266338752fd419f82d8761e9920dc99467ca2bf9683948ed96
Verdict:
Malicious
File Type:
zip
Link:
https://opentip.kaspersky.com/c22808c338b7dd266338752fd419f82d8761e9920dc99467ca2bf9683948ed96/results?tab=lookup
Score:
23%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/c22808c338b7dd266338752fd419f82d8761e9920dc99467ca2bf9683948ed96
Verdict:
Malware
YARA:
2 match(es)
Tags:
ADODB.Stream MSXML2.XMLHTTP Scripting.Dictionary Scripting.FileSystemObject Shell.Application WScript.Shell Zip Archive
Link:
https://app.malva.re/file/38bb81c81be570d40adefd736dc2512e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c22808c338b7dd266338752fd419f82d8761e9920dc99467ca2bf9683948ed96/
Threat name:
Win32.Trojan.Suschil
Create hunting rule
Status:
Malicious
First seen:
2026-03-10 09:57:20 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yiuarqzyw7osmyzyoux5igpyfwdwd2msbxeziz6kfp4wqoki5wla._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/260310-prx51aez4m/
Behaviour
Enumerates physical storage devices
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GoToResolve

zip c22808c338b7dd266338752fd419f82d8761e9920dc99467ca2bf9683948ed96

(this sample)

GoToResolve

Microsoft Software Installer (MSI) msi c1ee59108378686091c53a1259db7f467e3f3301b73f2f2523f70235ae11f68f

  
Delivery method
Distributed via web download
  
Dropping
SHA256 c1ee59108378686091c53a1259db7f467e3f3301b73f2f2523f70235ae11f68f
  
Dropping
MD5 cf63b84499450bb2ae2a4595b5cafce6
  
URLhaus
https://urlhaus.abuse.ch/url/3793556/

Comments