MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddfb4b9b8feb74bea278e7320aa66417823cfb7f3853322ba5f6e33b00e9c08a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Vidar

Vendor detections: 2

Intelligence 2 IOCs YARA 22 File information Comments

SHA256 hash:	ddfb4b9b8feb74bea278e7320aa66417823cfb7f3853322ba5f6e33b00e9c08a
SHA3-384 hash:	fa4e162885457627673dad02cf21ff354ef6c496d1f53c480b71f92f8804c1cb50225a1a8af2c1c4a52c41eea97fe779
SHA1 hash:	fd4cc54451a0c84df3fc799efa7dfac5044c4668
MD5 hash:	a3e346a25198f2d3d18caf0587515239
humanhash:	hamper-spaghetti-fix-cola
File name:	source code of carbanak backdoor discovered.7z
Download:	download sample
Signature	Vidar Create hunting rule
File size:	17'161'971 bytes
First seen:	2026-03-18 21:52:12 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 3306
ssdeep	393216:BwNCBTd5B739kxj5vR6t/sTgFN8ZxqPnBhZhq6H/QfYc7cgdRApX5XhR/0:BzBTdr9kLvR05FGE+6Jc7j3Ihrc
TLSH	T16007338E4F28246CB3B53F1A5419DAC3D9E0F954C5F8794F0ECD6B9B2BC86272661087
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	7z 95-85-239-146 AsgardProtector file-pumped LummaStealer pw-3306 vidar

iamaachum

https://media.hushholidays.online/Source+Code+of+CARBANAK+backdoor+discovered.zip

GoLoader C2: http://95.85.239.146:3000/V7sjDtINFKvD

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

File Archive Information

This file is a password protected archive. The password is: 3306

This file archive contains 1 file(s), sorted by their relevance:

File name:	source code of carbanak backdoor discovered.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	876'511'657 bytes
SHA256 hash:	2fd8a352ccd1d7dfe0442098030a52a94aea171abd9d7907878f35e757703536
MD5 hash:	6b3fba1d00d2047cf6202f6d96dc5c6a
De-pumped file size:	1'996'800 bytes (Vs. original size of 876'511'657 bytes)
De-pumped SHA256 hash:	3c87c17ae4e8ef7d193b41f48616aef4d95bdc871a0ac81e5c02ab97d5373079
De-pumped MD5 hash:	57b70694ac6549065a8ad3eb1e934b3b
MIME type:	application/x-dosexec
Signature	Vidar

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69bb1f2888c80c01586bcc61

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ddfb4b9b8feb74bea278e7320aa66417823cfb7f3853322ba5f6e33b00e9c08a

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/ddfb4b9b8feb74bea278e7320aa66417823cfb7f3853322ba5f6e33b00e9c08a/results?tab=lookup

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ddfb4b9b8feb74bea278e7320aa66417823cfb7f3853322ba5f6e33b00e9c08a/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3x5uxg4p5n2l5ity44zavjtec6bdz637hbjtek5f63rtwahjycfa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.