🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5d1874bec53d5afa09ef36ae3e88630122e14c6f224b14752e5bd014d51fe16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5d1874bec53d5afa09ef36ae3e88630122e14c6f224b14752e5bd014d51fe16
SHA3-384 hash: 1f900462a94190f27d2c22501ac36df10d2498fbf4d0244b238b1c9f4c74eb227773b4bff5168cfd3fbfcfd9f8c926ed
SHA1 hash: 04a041139a68e3d40f47d4e428ce1bca25f7e1ee
MD5 hash: 2e991f44253df774654ff35853135466
humanhash: august-bravo-solar-zulu
File name:mbupload-100x05rt.bin
Download: download sample
File size:11'275'165 bytes
First seen:2026-10-16 04:32:30 UTC
Last seen:Never
File type: rar
MIME type:application/vnd.rar
ssdeep 196608:JNat5ZGfGOSMKFP9QDk/CKC5NqOxd4/9rt6BSQ1Fd4EyVA:Jct5Z6G1MKFP+I//C5N34FroSQf+EyS
TLSH T102B633B7E03B81D94AED2904F25991A000B01DA991731C26F31B6B5ABBE0FF70D6577E
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter wristhulk
Tags:rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
US US
File Archive Information

This file archive contains 30 file(s), sorted by their relevance:

File name:bot_actions.cpython-311.pyc
File size:9'157 bytes
SHA256 hash: 3fa32c3ed96eaa0aa4d04786a48a2385f150356d17163af0d90a212c0242439d
MD5 hash: 60a1e896591a533c98e28e878d75203a
MIME type:application/octet-stream
File name:env.cpython-311.pyc
File size:5'219 bytes
SHA256 hash: f919ff801663e41a070593e90ff3f21be0df7ead8f7ccad72f7e1a1062e54824
MD5 hash: a1f2f363ac2905c5f3aa1ff75d916006
MIME type:application/octet-stream
File name:gateway.cpython-311.pyc
File size:4'923 bytes
SHA256 hash: 6217238121b6f9e1aa0c7d61e803d5b1b76f2c69db2c6c82e8a3764a51d1b434
MD5 hash: 6793eacb122722be483e725432d54088
MIME type:application/octet-stream
File name:vault.cpython-311.pyc
File size:8'483 bytes
SHA256 hash: 9f17b888e92fd2343a48bcf04a8821e09a433a2ebb87d93295532eaefa0094a4
MD5 hash: cc7391c7f1d0575a1d730b889b5849b9
MIME type:application/octet-stream
File name:run.bat
File size:798 bytes
SHA256 hash: 04840b6889f566aac54af9ce8db23423324df2f60aae05d6a401150ab3f6ba9f
MD5 hash: 8deee9ab3d1509c86ac8ff920b31b727
MIME type:text/x-msdos-batch
File name:about.cpython-311.pyc
File size:3'993 bytes
SHA256 hash: 43a2a91c2a37fa87ce5b2f64dadb729b1c23a45692a65cbc3f51ffe5c05f71d1
MD5 hash: 60e515c32155a09e31d4d2d3c3cb6e5c
MIME type:application/octet-stream
File name:ui.cpython-311.pyc
File size:10'337 bytes
SHA256 hash: 678bb0968041b24a3271f5e3db8112fc56266a093a23a42163ab455c04e637de
MD5 hash: e7e26b9ec73997d6f7b8ecbcc2f2638d
MIME type:application/octet-stream
File name:executor.cpython-311.pyc
File size:7'548 bytes
SHA256 hash: 4580b9b085f78b09f189bd4b3b583093db0602c863f4cbacb515ed9c5e0d2071
MD5 hash: 39f696bc39a852e672da1d1c8e30703e
MIME type:application/octet-stream
File name:install.cpython-311.pyc
File size:3'569 bytes
SHA256 hash: 0f373e524aafdde338dee620c2dcbc8ee10dc4da38b95c45817f82ff77bdac23
MD5 hash: 5cf6c5b12c319d6419bdc0ce03acb6ce
MIME type:application/octet-stream
File name:config.cpython-311.pyc
File size:3'135 bytes
SHA256 hash: a9be630064df6402ce239dfa55fa67049bbadaa5c0f88697ce0859302b32ccd8
MD5 hash: 90e4c2063c49599f3525a8e53b110ee1
MIME type:application/octet-stream
File name:settings.cpython-311.pyc
File size:2'834 bytes
SHA256 hash: 156f70c7d7319656b3c4ad2a2c5c38fc841ab86465f1e906db0c7eec3451a591
MD5 hash: c4affc039ba69c9d2cb75c99cc54d352
MIME type:application/octet-stream
File name:__init__.cpython-311.pyc
File size:9'769 bytes
SHA256 hash: 10ff921505a8e85480dbdea0122accede06851966a7e2ae241a982696872253b
MD5 hash: 57ecfab834e1dd7baa96dd10d6877e77
MIME type:application/octet-stream
File name:main.cpython-311.pyc
File size:6'433 bytes
SHA256 hash: a7d62152b64efab9bc126045804a00665890e537b04560adfcdf81f3807e7bdb
MD5 hash: e0445a9f4d56332cd1fb03620778187c
MIME type:application/octet-stream
File name:requirements.txt
File size:84 bytes
SHA256 hash: fa5637fee9cca92ac852e60c29a4898e85e8a29e8a153c8f3510954071122cd2
MD5 hash: 150bc45a04eddbd50ac0a297dc8f0e7e
MIME type:text/plain
File name:gateway.py
File size:2'672 bytes
SHA256 hash: 6880b1dd8b4f3a61be5136d98d724bb658763a5734d434708a567c2a8de81ac6
MD5 hash: 6641436ed5085597f6ceeeaf4decfdae
MIME type:text/x-python
File name:install.py
File size:1'786 bytes
SHA256 hash: 6cb699a2eb307f831555bb7919ac055835cce533f96cc1c6ed821632e4163806
MD5 hash: 80fb1b06caf6f427cd3f439bd0696368
MIME type:text/x-python
File name:ui.py
File size:5'780 bytes
SHA256 hash: 4d946f1c72d982b5a7401be2e5f1b307ff4114dda27b800f0464431d1862c216
MD5 hash: 22bf7c972bca61f383e59650b7ce4813
MIME type:text/x-python
File name:executor.py
File size:5'013 bytes
SHA256 hash: 46913b5ac710617a6f0ffcac96c38156894a9d6fd8ba343e87e111f823d4909a
MD5 hash: d34761b36fd0ae51e19c50b4ddb57c82
MIME type:text/x-python
File name:config.json
File size:318 bytes
SHA256 hash: e9997aa46eeddd5f3aac258db733b90feeb659c732fc65a4f1cfb905d9c8c19a
MD5 hash: 88890e4c936ddbf411915526693ee61d
MIME type:application/json
File name:__init__.py
File size:5'258 bytes
SHA256 hash: 048bd1e412bd3970f1ba4af3a32adc21b1fe44064f2f20034090408073500848
MD5 hash: af3a9ad624ba57a483a0cc7178f039d9
MIME type:text/x-python
File name:main.py
File size:4'215 bytes
SHA256 hash: c29d85f313baa088a9e86a102516ae6d32f6b35be8965d5ffb1e20040eb8b5b9
MD5 hash: fe81e69b0a1e0daef102e21032d4bfc2
MIME type:text/x-python
File name:settings.py
File size:1'531 bytes
SHA256 hash: 4d9ee5b06ac4d6536a1bf8929dbe6c64f1303d46322eee1778009766a0e128d8
MD5 hash: 4bb5c6363e39118aa9cf54bf3e70cf1c
MIME type:text/x-python
File name:README.md
File size:502 bytes
SHA256 hash: dd8e5471c02e6b1c53aa858a1a9d1068f60a364bf0cd4ba3dfaf7cd32e0e88c3
MD5 hash: 85153aa7ff21fc5a1af7ba6100664ccf
MIME type:text/plain
File name:about.py
File size:2'580 bytes
SHA256 hash: 7ee64a9f88b3d7cf7130f7a1a685df4ac540d58f64ddd82d94b267c544d844c6
MD5 hash: 89201228290ad1a08cbe892ffaf0ad45
MIME type:text/x-python
File name:bot_actions.py
File size:4'987 bytes
SHA256 hash: bf2264a2e14877ba6800ce9cff8f79c1444bd1d0a4a945441bd26bc5a8ed9200
MD5 hash: fa5666c0702798733394bf0695802d25
MIME type:text/x-python
File name:store.bin
File size:11'249'149 bytes
SHA256 hash: 85e60fa44f02780b933da5c5a403c28d65d13b9592e6cb987bf56e11f67ba381
MD5 hash: 5fde0ce16bbc83eaabe48b112bf1f6ce
MIME type:application/zip
File name:env.py
File size:2'879 bytes
SHA256 hash: 2b52256cf03f2483f5574bdff4b1d9b948979cc77f065db4860919148f5a992f
MD5 hash: 869f94478ac8b238cdb8f1f1af687c26
MIME type:text/x-python
File name:vault.py
File size:4'195 bytes
SHA256 hash: 62186959889737ef11ef1ddae71d7011c7a6f9272a9f6ad909bd27bb37ff2f4c
MD5 hash: 11bb1d94d8a4f73595e7bcfb1146212f
MIME type:text/x-python
File name:run.sh
File size:232 bytes
SHA256 hash: e1b61c8ced6ce94228fb61f4dc20618dfc1d1007ba3b3d9fdc610adb5a595301
MD5 hash: 6d5c94f5c9a49095bffd81e6f201a887
MIME type:text/x-shellscript
File name:config.py
File size:1'654 bytes
SHA256 hash: acfb8905476f6096b598c52981169fba6436b68c145a878c9cbd843f778e6266
MD5 hash: e729711c15e3e656f7f8c2bdc6a3a78a
MIME type:text/x-python
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/8057956e-753d-42d6-8912-451e86636328/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad1ba3b6f551121ba16820d
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d5d1874bec53d5afa09ef36ae3e88630122e14c6f224b14752e5bd014d51fe16
Verdict:
Unknown
File Type:
rar
First seen:
2026-10-16T04:08:00Z UTC
Last seen:
2026-10-18T00:13:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d5d1874bec53d5afa09ef36ae3e88630122e14c6f224b14752e5bd014d51fe16/results?tab=lookup
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated Executable PDB Path PE (Portable Executable) PE File Layout PowerShell Rar Archive T1027 T1059.001 T1059.005
Link:
https://app.malva.re/file/2e991f44253df774654ff35853135466
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5d1874bec53d5afa09ef36ae3e88630122e14c6f224b14752e5bd014d51fe16/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-16 04:33:17 UTC
File Type:
Binary (Archive)
Extracted files:
1439
AV detection:
3 of 38 (7.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xiyos7mkpk27ie66nvoh2eggajc4fgg6islcr2s4w6qctkr7yla._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/261016-f7vkdahx5x/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/d5d1874bec53d5afa09ef36ae3e88630122e14c6f224b14752e5bd014d51fe16

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

rar d5d1874bec53d5afa09ef36ae3e88630122e14c6f224b14752e5bd014d51fe16

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3950810/
  
Delivery method
Distributed via web download

Comments