MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db7cb7bae37db224384a9c19dc75061ea3302471bb5963a27017034d43ede1ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	db7cb7bae37db224384a9c19dc75061ea3302471bb5963a27017034d43ede1ad
SHA3-384 hash:	b9b74847010e273226d7581584672e87fcd28c711b937c0ac45b1f8cb20519decde6ebb699bd47864a954a9666e0202f
SHA1 hash:	b3554bb87943622b14073eee3d95f0698372ab76
MD5 hash:	acfaf9e0c1018b85b9e8fc4acc5047c6
humanhash:	ohio-fish-uncle-snake
File name:	AWB_1337089423.rar
Download:	download sample
File size:	714'063 bytes
First seen:	2026-10-14 15:16:27 UTC
Last seen:	2026-10-14 15:17:26 UTC
File type:	rar
MIME type:	application/vnd.rar
ssdeep	12288:1xDZ8waA5a1s6C1bl/ifl5xx1PBkqh31QsqEcuxa1kwAK1yc8rZlcjBPAQXWHd:1zB5am6Gbhit5xxdSqDhqfu4D/kcjGQo
TLSH	T1FCE423D57A11D2EE9D50DA78BB29B4B68C83DEA4823CC0D3571CC84ACD02FFC51B5996
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

35

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	AWB 1337089423.vbs
File size:	38'198'386 bytes
SHA256 hash:	71808b3219a19a8c62c7f1fec4fe1140aa2a6d6a6f11094564cd4753937827ec
MD5 hash:	dd9bc2ece8f01fa061dd59bef244aa57
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ac3708e8-afe1-4883-acf4-d449c4660ba9/

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad14b1c6f551121ba16594d

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 evasive fingerprint powershell

Link:

https://www.filescan.io/uploads/6acf9d1fd3bae837b818b4fc/reports/7d229255-f5e7-491d-bbb8-3602e7dbaa17/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/db7cb7bae37db224384a9c19dc75061ea3302471bb5963a27017034d43ede1ad

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

rar

First seen:

2026-09-15T23:46:00Z UTC

Last seen:

2026-10-06T04:04:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/db7cb7bae37db224384a9c19dc75061ea3302471bb5963a27017034d43ede1ad/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/acfaf9e0c1018b85b9e8fc4acc5047c6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db7cb7bae37db224384a9c19dc75061ea3302471bb5963a27017034d43ede1ad/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-17 21:22:06 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

7 of 23 (30.43%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3n6lpoxdpwzciocktqm5y5igd2rtajdrxnmwhitqc4bu2q7n4gwq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261014-s3ysfsxthy/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/db7cb7bae37db224384a9c19dc75061ea3302471bb5963a27017034d43ede1ad