MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d448dfee940f4cbb2c26702951998ebeda7d24f137047a10ea8fbcbb6a903fab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d448dfee940f4cbb2c26702951998ebeda7d24f137047a10ea8fbcbb6a903fab
SHA3-384 hash: dba806599d6d7088b3d1776821b8e25c8d936fee39007849b036f6e936d6f4cb5986e046b56bd0bbf4c8563ee384b0c4
SHA1 hash: ef762657a3de5ab8632d13691592f5b86cda9c77
MD5 hash: d7dd5ca239dd204fe8a51215028b9bd1
humanhash: september-papa-comet-aspen
File name:ProtokolZatrimannya.zip
Download: download sample
File size:107'212 bytes
First seen:2026-07-12 10:29:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 192:3cc5C3gfZJr5Gc5wjD9IurjD9IMcIAzPucB/CRc7dTXB2JD:3cc4QfZJr5GcuP9cIGuc5yc5TXB2JD
TLSH T1A1A3103475D81019E1F3EF72ACF477C5AEABF677B9B2125D1850160A4912E80EE12B3B
Magika zip
Reporter smica83
Tags:UKR zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
HU HU
File Archive Information

This file archive contains 7 file(s), sorted by their relevance:

File name:ProtokolZatrimannya.docx.lnk
File size:19'690 bytes
SHA256 hash: c783aca3fd2464568bf416912bd0f052d15278910b97025edea67e770308ecbf
MD5 hash: 9b9ee0a683838f16f71497b6f7addb58
MIME type:application/octet-stream
File name:ScanPassportiv1.pdf.lnk
File size:16'558 bytes
SHA256 hash: 119a7ff8088bba7861ccd0dc9ba96a144636c692ff63acfd95db62527f5f4e75
MD5 hash: 8e8db244348ae44705260b51edfd1e60
MIME type:application/octet-stream
File name:ScanPassportiv2.pdf.lnk
File size:16'304 bytes
SHA256 hash: e785fef4921541ae0c2da3b350a489d0c2290377b56a4890d7cf78ada4f263e6
MD5 hash: a7ed723984e6417a45ad5756ebcd0c5b
MIME type:application/octet-stream
File name:ScanPassportiv3.pdf.lnk
File size:16'511 bytes
SHA256 hash: fd53fe5d08d31903ea018c27668eb85e529ce6e30573b8e41a8f7d7c6869cc66
MD5 hash: 0d078913b768c65a51aa8e80fb09ef95
MIME type:application/octet-stream
File name:ScanPassportiv4.pdf.lnk
File size:16'500 bytes
SHA256 hash: 9262d422a88e1613a6bec489aa93411e64ba976cd2a0596339513a4a7ce3cf79
MD5 hash: 3d069e5cfa5b789e1ce23502ec219031
MIME type:application/octet-stream
File name:SpisokZatrimanih.xlsx.lnk
File size:19'602 bytes
SHA256 hash: 12effef59a3c09f6dc304a8f927e8afe03873915da2df5f761c321f19e6161b9
MD5 hash: 7a6d03eb8863ccf9ce0ce905db53e9a2
MIME type:application/octet-stream
File name:ReadMe.txt
File size:1'183 bytes
SHA256 hash: 65419cb512774e0022d3672333a4e85135c7def8e3c241debe1ff4edeee7a450
MD5 hash: ac8cc4734a770562b33d735efda8421f
MIME type:text/plain
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/41b7617d-fb6b-4a06-9fd0-11a9818afc2d/
Detection(s):
Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL
Create hunting rule

Sanesecurity.Foxhole.Zip_docx.UNOFFICIAL
Create hunting rule

Win.Trojan.Suspect-34
Create hunting rule

Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Foxhole.Zip_xlsx.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27118.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADayDownloaders.20231121.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.HotMetalDobermans.20240516.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Zip.LNK-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a536cdc749f0a5acf20e907
Tags:
dropper xtreme sage
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d448dfee940f4cbb2c26702951998ebeda7d24f137047a10ea8fbcbb6a903fab
Verdict:
Malicious
File Type:
zip
First seen:
2026-07-11T00:47:00Z UTC
Last seen:
2026-07-12T10:10:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d448dfee940f4cbb2c26702951998ebeda7d24f137047a10ea8fbcbb6a903fab/results?tab=lookup
Verdict:
Malware
YARA:
3 match(es)
Tags:
Execution: CMD in LNK LNK LOLBin LOLBin:cmd.exe Malicious T1059.003 T1202: Indirect Command Execution T1204.002 Zip Archive
Link:
https://app.malva.re/file/d7dd5ca239dd204fe8a51215028b9bd1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d448dfee940f4cbb2c26702951998ebeda7d24f137047a10ea8fbcbb6a903fab/
Threat name:
Shortcut.Trojan.Suschil
Create hunting rule
Status:
Malicious
First seen:
2026-07-10 23:50:00 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
12 of 36 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ren73uub5glwlbgoauvdgmox3nh2jhrg4chuehkr66lw2uqh6vq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion execution
Link:
https://tria.ge/reports/260712-ntmllsg15m/
Behaviour
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Deobfuscate/Decode Files or Information
Checks computer location settings
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d448dfee940f4cbb2c26702951998ebeda7d24f137047a10ea8fbcbb6a903fab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Certutil_Decode_OR_Download
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Certutil Decode
Reference:Internal Research
Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_SuspiciousCommands
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects LNK file with suspicious content

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments