MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5474d5f9e9888b2bfceda28bddc7053f28940bfc15a49569adc0d0db6618cf6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5474d5f9e9888b2bfceda28bddc7053f28940bfc15a49569adc0d0db6618cf6
SHA3-384 hash: 1ab8312f4e689105f014f6a0e8a2da3bc05e84eb9ddb724f1e91ee7b1e8575a66c04a34aba45db092830184de9986831
SHA1 hash: bf927fc28831e5b05b9a4bf31973b00efd3cd7f7
MD5 hash: 1f14663cd5d45dc7eb2dec47ca2d3ca3
humanhash: paris-september-ack-venus
File name:newbeaver.py.zip
Download: download sample
File size:15'138 bytes
First seen:2025-04-22 16:02:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: infected
ssdeep 384:TDWHSdmMe9oOSxU7283M2g0C5UOme/T3oqi:uCmMlOmU7283M2QSOncqi
TLSH T13762D0C3071AD5BAC810D1382C38D66FC4E68D0B26A651C7D748BDB236E410DC5EE55F
Magika zip
Reporter masoladoye
Tags:InvisibleFerret newbeaver zip


Avatar
masoladoye
InvisibleFerret is a Python-based malware that, at first glance, shows a disorganized structure and unnecessary escaping sequences, giving a glimpse of what lies ahead if we dare to explore the code further. A quick look reveals a compact initialization of hardcoded constants used to install dependencies via pip, which are later reused multiple times throughout its execution.

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
NG NG
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:newbeaver.py
File size:54'396 bytes
SHA256 hash: 2012f6f7d8add86ebbc6629815832554fca37cc3e1edab68a51f57e345365f85
MD5 hash: 30ee0cc21753e27dd45a7cedc1271cda
MIME type:text/x-python
Vendor Threat Intelligence
Result
Verdict:
Unknown
File Type:
ZIP File
Link:
https://app.docguard.net/c5474d5f9e9888b2bfceda28bddc7053f28940bfc15a49569adc0d0db6618cf6/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint
Link:
https://www.filescan.io/uploads/6807bdc789fec6b88ba0bdec/reports/1292afee-6f6c-44aa-b7b9-22e5252b3612/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c5474d5f9e9888b2bfceda28bddc7053f28940bfc15a49569adc0d0db6618cf6
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c5474d5f9e9888b2bfceda28bddc7053f28940bfc15a49569adc0d0db6618cf6
Score:
84%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/c5474d5f9e9888b2bfceda28bddc7053f28940bfc15a49569adc0d0db6618cf6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5474d5f9e9888b2bfceda28bddc7053f28940bfc15a49569adc0d0db6618cf6/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yvdu2x46tcelfp6o3iul3xdqkpzisqf7yfnesvu23qgq3ntbrt3a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250422-tkykeavkt4/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
InvisibleFerret
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c5474d5f9e9888b2bfceda28bddc7053f28940bfc15a49569adc0d0db6618cf6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/1951b184-a2fe-4cff-9999-cea0320910d4
  
Dropped by
newbeaver
  
Delivery method
Multiple

Comments