🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcbe27c0161bdf1922bf060c50b086031a7ffde000bff3bf4fae3df10bbbd096. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcbe27c0161bdf1922bf060c50b086031a7ffde000bff3bf4fae3df10bbbd096
SHA3-384 hash: 162532b23c217d694786fc03e01a619a8713842397c1393f75b34e6757db42e49a9bb43472f5c0129c5285a389a83031
SHA1 hash: c3bde724d88b047fe11a90ffe31fe9cfa66bc2d8
MD5 hash: e810f3f39f28f0335b9c2c5aa589a54a
humanhash: foxtrot-west-minnesota-tennessee
File name:mbupload-g4p5uyvx.bin
Download: download sample
File size:11'260'365 bytes
First seen:2026-10-16 04:31:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:+Y2ZBID3eWh6bmh1EtbmJ9DuYOZauzFTyN3mgg/tkJY+0Td5UWmgFzmOO/fb9:+YuID37hjhaxmJ96YrsTy1mNFkJYAWmH
TLSH T1DBB633D8DC8615CAF5CB7D399BB434ABD1C02A294B61F2ECD047B3E09A7E1F80D91469
TrID 66.6% (.XPI) Mozilla Firefox browser extension (8000/1/1)
33.3% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter wristhulk
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
US US
File Archive Information

This file archive contains 28 file(s), sorted by their relevance:

File name:env.cpython-311.pyc
File size:4'970 bytes
SHA256 hash: 0933b22e2b75f2acf354994de0646cbfe6be60bbbcb114327ceaee4dedc35d11
MD5 hash: 62670b44bf1bf7a3697554d789c89b9c
MIME type:application/octet-stream
File name:encoder.cpython-311.pyc
File size:8'243 bytes
SHA256 hash: 7eca6d66b82ca49da4cff3bd1cf7c9e85c79cd82da9fe073392914b37a0e1a52
MD5 hash: 2f153b185738b2df54ab03791febe742
MIME type:application/octet-stream
File name:runner.cpython-311.pyc
File size:9'764 bytes
SHA256 hash: 207a8bdcb8b4ad5fe367a8bbab4e18b25c744a63d4785dcf8faea3c46e617e4a
MD5 hash: f2a206a8dadd4010e3f98de0cb323c27
MIME type:application/octet-stream
File name:run.bat
File size:623 bytes
SHA256 hash: 6ba7b45ed2ae00d6895c4f5419c93a31e867cecd4f6c97089e31112fa77cf410
MD5 hash: 64347aa0f9aa17fef8f4c0501dd6b0b4
MIME type:text/x-msdos-batch
File name:ui.cpython-311.pyc
File size:8'069 bytes
SHA256 hash: 8c717926d384448f35fd311b0124fa7cdba0962bc1ffb8736980be3e8f012464
MD5 hash: 636c08d366d31c82f83bfcb6bd77c5f0
MIME type:application/octet-stream
File name:sender.cpython-311.pyc
File size:5'418 bytes
SHA256 hash: 3939f6c11b49637ea8c0edc4c4265b4ec4a7c4689395e1c41b953140defbc99c
MD5 hash: f9d4b1be50084e93aa0b8a78a24b77a2
MIME type:application/octet-stream
File name:__init__.cpython-311.pyc
File size:9'093 bytes
SHA256 hash: 96ad2785e606cd6c6c07287d17728d3dcc59039c807a0460f4397a41e47455d5
MD5 hash: 4daa49e0d7cb2e0a22889231d74bc941
MIME type:application/octet-stream
File name:main.cpython-311.pyc
File size:6'870 bytes
SHA256 hash: f2d962d89edcd12adbffc0ff741cb73d1e540b160b078fffece918fb57b02428
MD5 hash: b09a4d1a8f1009b282c2a34388ab8199
MIME type:application/octet-stream
File name:injector.py
File size:1'268 bytes
SHA256 hash: 9aed8cc54f4cfe330bfaf2d34834b2bd760ea0415d65905a6e0ce73583618e56
MD5 hash: 0a949f5035f688685fe92f23f2750dc0
MIME type:text/x-python
File name:runner.py
File size:4'983 bytes
SHA256 hash: 79b5e282d103faed4609a638d7b6802c11aa83769bd0dde6aed74497530a18c0
MD5 hash: e18697facb4c1b7d1e1fc2dcee453de3
MIME type:text/x-python
File name:scanner.py
File size:2'857 bytes
SHA256 hash: 1e0518a9424002c4468be3c8f4028d9dcc22a99a88a7d2e79e2de3c7fec21383
MD5 hash: f555b587780afdd169819a5b91878a78
MIME type:text/x-python
File name:requirements.txt
File size:99 bytes
SHA256 hash: c341ad2e9d8a3505e82f2d1cd13f58420a346bef9d8d01226570584612be52ea
MD5 hash: b6a1a18e2a1ef46fdfb1fb6392cc0803
MIME type:text/plain
File name:install.py
File size:1'931 bytes
SHA256 hash: b0ec0ef33a67e17fafed6201413189f3c9f90ebbd3c8da8ba52c4d387e21b98b
MD5 hash: f33081cb73e29184d31d675a6a568143
MIME type:text/x-python
File name:ui.py
File size:3'960 bytes
SHA256 hash: 3fa305993eee0fbf88fb18de11826b9ab6b07a4cae827b18c3fb956430c99aa2
MD5 hash: f610ecbb7c5c2550118d3bda67f6538b
MIME type:text/x-python
File name:scan.bin
File size:11'249'026 bytes
SHA256 hash: 663bc9b60fedd186766837c3b16c72e6875308818ef8741ebaa177f263fed240
MD5 hash: faebf57f03eeea92348438ba3c0af35c
MIME type:application/zip
File name:clipboard.py
File size:1'894 bytes
SHA256 hash: 4ca7909beb4afb7fc40d93b4cd049ad03ce9ad0aa8a2286d293c1815f2483310
MD5 hash: a98bd8abf8bd30e14ddf76317ba0b151
MIME type:text/x-python
File name:__init__.py
File size:4'817 bytes
SHA256 hash: a9df683647249a5c20df0605d657f5385fd256590046bc6e1c4d9c8279641f5b
MD5 hash: 65a46022e0a26f748170d3a9258e3a3d
MIME type:text/x-python
File name:main.py
File size:4'185 bytes
SHA256 hash: 312ecde0d2caae4e07d478268313b232f8a0005ae74a0886182f73c0750fc1b8
MD5 hash: 0fdfb5d350861ba96dde2c400089ec44
MIME type:text/x-python
File name:settings.py
File size:2'666 bytes
SHA256 hash: 430590533b4b3532bd9f721e26218727928b888b72a6e067dd142aa35ed9facb
MD5 hash: 588c3f1d8c3261a4e98efef6891c1d26
MIME type:text/x-python
File name:README.md
File size:420 bytes
SHA256 hash: 771acabb16de8f2299065b0fff17b3fa031bf27a0dba0c8fb8b60705d7ad2962
MD5 hash: e600432e1ed3488fe92d948d9cdc4093
MIME type:text/plain
File name:filter.py
File size:1'893 bytes
SHA256 hash: 32116999761b3e6c1d996966a21a992eb22a5f123d65f90c9328c3c5a4d99ede
MD5 hash: 80cbdefb10ada2bf53a2dffb12741e7b
MIME type:text/x-python
File name:about.py
File size:2'847 bytes
SHA256 hash: 04f5ab6420e8cb606655a7dda66361a779abafc2d773c8ed2b54cdb570554848
MD5 hash: e411eed16ed87d4b271a43125b2fe0a1
MIME type:text/x-python
File name:bot_actions.py
File size:11'752 bytes
SHA256 hash: c8095bcf8141485c534aa60b52ba849962cc0931c9af4efcc8b6c649bc1e93f2
MD5 hash: a855857df5bfb59f1607494addab0abb
MIME type:text/x-python
File name:sender.py
File size:2'835 bytes
SHA256 hash: 479d299a4686cb1ba61fad3e86c576214ec9a66c4c4b64ec1894392a2d73e9f6
MD5 hash: db61e905052c1dc4942bff250cad6c32
MIME type:text/x-python
File name:env.py
File size:2'891 bytes
SHA256 hash: 767758e8ddaaeda78dc468da1715c4582d51eb9d450483d79683bf1048257187
MD5 hash: 836856d2e0dcf0fbf8c65e905f6d5a20
MIME type:text/x-python
File name:run.sh
File size:669 bytes
SHA256 hash: 3d42f57d1efb618bba2d378cdd6d3bf2766f4630d3b658d45bec1d241b08d690
MD5 hash: 9e92b5274f4829aa1efcaf89b19b8867
MIME type:text/x-shellscript
File name:config.py
File size:1'967 bytes
SHA256 hash: 00b240d264a7c9b58717c5726583a726091a96297ea77f21b78b50802d10e50a
MD5 hash: 6e5414fa24caf946d02e89cdb105c1a9
MIME type:text/x-python
File name:encoder.py
File size:4'080 bytes
SHA256 hash: 7cbe6a54fab34dc4bda0687215ec3a4a62b6c2de138c0f904980d2fea7d8109a
MD5 hash: 4eec2a7e88ccf99a020a05dc95f06c2c
MIME type:text/x-python
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4cf69028-e64c-4dc2-a8f1-ebc2a030ef36/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad1bb646f551121ba1683c8
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/dcbe27c0161bdf1922bf060c50b086031a7ffde000bff3bf4fae3df10bbbd096
Verdict:
Unknown
File Type:
zip
First seen:
2026-10-16T04:08:00Z UTC
Last seen:
2026-10-17T22:15:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/dcbe27c0161bdf1922bf060c50b086031a7ffde000bff3bf4fae3df10bbbd096/results?tab=lookup
Score:
66%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/dcbe27c0161bdf1922bf060c50b086031a7ffde000bff3bf4fae3df10bbbd096
Verdict:
Malware
YARA:
4 match(es)
Tags:
DeObfuscated Executable PDB Path PE (Portable Executable) PE File Layout PowerShell T1027 T1059.001 T1059.005 Zip Archive
Link:
https://app.malva.re/file/e810f3f39f28f0335b9c2c5aa589a54a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcbe27c0161bdf1922bf060c50b086031a7ffde000bff3bf4fae3df10bbbd096/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-11 17:28:24 UTC
File Type:
Binary (Archive)
Extracted files:
1429
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3s7cpqawdpprsiv7aygfbmegamnh77paac77hp2pvy67cc532cla._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/261016-f7wsfaxxf1/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/dcbe27c0161bdf1922bf060c50b086031a7ffde000bff3bf4fae3df10bbbd096

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip dcbe27c0161bdf1922bf060c50b086031a7ffde000bff3bf4fae3df10bbbd096

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3950801/
  
Delivery method
Distributed via web download

Comments