🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9408cc616e2eefcff4f6dc0a41178aeca03c9250a39640552807804d8c04a3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SalatStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9408cc616e2eefcff4f6dc0a41178aeca03c9250a39640552807804d8c04a3b
SHA3-384 hash: fd3ed9c84b631870aabcfd6f42752bb1838a2196f38f0061801fe191e32662fbb096c87115f26f9405f1e4158025f9f9
SHA1 hash: 2aa21a7252215963a70cc5a36bf92231fca26447
MD5 hash: ba805149c4da95f8060226d4469ad63a
humanhash: charlie-low-lemon-sink
File name:база данных.rar
Download: download sample
Signature SalatStealer
Create hunting rule
File size:3'302'059 bytes
First seen:2026-02-14 23:50:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 98304:R01avRLQpu3Yevm845WVLjWjU63kj9+EU:RL33DJ4cjWjSW
TLSH T17BE5334ECB6BB3D94A9F85539DDC2E023E572E1C73260BA5E4F25A305560A04AF43FB4
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter smica83
Tags:CVE-2025-8088 rar SalatStealer UKR

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
HU HU
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:Funtime acc dump 2026.txt
File size:23 bytes
SHA256 hash: a4d597f9d9145f36b235a2106f14fa602890499c4ca6aa829a140cd856d52f31
MD5 hash: b18b3b605c6db0b146e8ec99109adfbe
MIME type:text/plain
Signature SalatStealer
File name:Funtime acc dump 2026.txt:.._.._.._.._.._.._.._.._ProgramData_Microsoft_Windows_Start Menu_Programs_Startup_Updater.exe
File size:3'297'792 bytes
SHA256 hash: 46b90f9ed34a51167e1a6ec86852a173bd27f932215e78dd7ee121f9c814e0c9
MD5 hash: 609a406d32d394fe7a72e2800cfcedcd
MIME type:application/x-dosexec
Signature SalatStealer
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e9b1ab17-3017-49e1-b89e-6ca4882e076c/
Detection(s):
TwinWave.EvilRAR.GhettoSuperstream.20241120.UNOFFICIAL
Create hunting rule

TwinWave.EvilRAR.HongKongGarden_CVE-2025-8088.20250812.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69910a760d0369ff99797b1a
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/69910a722ffccda0976fe731/reports/8e0a775f-2c41-436b-9cd0-e9bca603e8f9/overview
Verdict:
Suspicious
Labled as:
CVE-2025-8088
Link:
https://www.hybrid-analysis.com/sample/c9408cc616e2eefcff4f6dc0a41178aeca03c9250a39640552807804d8c04a3b
Verdict:
Malicious
File Type:
rar
Link:
https://opentip.kaspersky.com/c9408cc616e2eefcff4f6dc0a41178aeca03c9250a39640552807804d8c04a3b/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Rar Archive
Link:
https://app.malva.re/file/ba805149c4da95f8060226d4469ad63a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9408cc616e2eefcff4f6dc0a41178aeca03c9250a39640552807804d8c04a3b/
Threat name:
Win32.Spyware.SalatStealer
Create hunting rule
Status:
Malicious
First seen:
2026-02-14 21:30:25 UTC
AV detection:
19 of 38 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfaizrqw4lxpz72pnxakielyv3fahsjfbi4wibksqb4ajwgaji5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c9408cc616e2eefcff4f6dc0a41178aeca03c9250a39640552807804d8c04a3b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_RAR_NTFS_ADS
Create hunting rule
Author:Proofpoint
Description:Detects RAR archive with NTFS alternate data stream
Reference:https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats
Rule name:WinRAR_ADS_Traversal
Create hunting rule
Author:@bartblaze
Description:Identifies potential ADS traversal in RAR archives, seen in vulnerabilities such as CVE‑2025‑6218 and CVE-2025-8088.
Reference:https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
Rule name:WinRAR_CVE_2025_8088_Exploit
Create hunting rule
Author:marcin@ulikowski.pl
Description:Detects RAR archives exploiting CVE-2025-8088 in WinRAR
Reference:https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments