MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcea95d8021d391a16c8e1fcebbd55ea8eb65f0f9dd76bac1eee7af1e2b4a4a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dcea95d8021d391a16c8e1fcebbd55ea8eb65f0f9dd76bac1eee7af1e2b4a4a3
SHA3-384 hash:	316dcb24acefc668e7f448c79adcab9fec1f33c89c5714bb48332c7fcf6605aa9e180e4edafa4ba4cb83192d4b88ba98
SHA1 hash:	2b2f4d9b7f58ec397faa33468bbf12fc42b8c070
MD5 hash:	9eb8900aaa5c306f7080009e5c37e781
humanhash:	five-colorado-uncle-colorado
File name:	NewXQuote.rar
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	822'159 bytes
First seen:	2026-06-12 21:52:14 UTC
Last seen:	2026-06-12 21:54:39 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:X4A26I860EDOqHqndvOx6OceGR8zZcJYt2CLmlC6A1:XRV56p6tdvI6kG2zyYYCKlU1
TLSH	T1B80533F91B73B221897867ABD8EDCC22E331DE5824E93E38597C003844577F98276867
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	FormBook rar

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

71

Origin country :

CH

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/68f76ec5-f686-4803-b658-60150a163f41/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.3581.18163.20691.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a26d59fae2f98c00a68e4ce

Tags:

n/a

Hybrid Analysis Trojan.Agent

Verdict:

Suspicious

Labled as:

Trojan.Agent

Link:

https://www.hybrid-analysis.com/sample/dcea95d8021d391a16c8e1fcebbd55ea8eb65f0f9dd76bac1eee7af1e2b4a4a3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-08T13:50:00Z UTC

Last seen:

2026-06-12T12:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dcea95d8021d391a16c8e1fcebbd55ea8eb65f0f9dd76bac1eee7af1e2b4a4a3/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dcea95d8021d391a16c8e1fcebbd55ea8eb65f0f9dd76bac1eee7af1e2b4a4a3/

ReversingLabs TitaniumCloud Win32.Trojan.PureLogStealer

Threat name:

Win32.Trojan.PureLogStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-08 10:39:34 UTC

File Type:

Binary (Archive)

Extracted files:

32

AV detection:

25 of 36 (69.44%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3tvjlwacdu4rufwi4h6oxpkv5khlmxyptxlwxla65z5pdyvuusrq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dcea95d8021d391a16c8e1fcebbd55ea8eb65f0f9dd76bac1eee7af1e2b4a4a3