MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de63dfaf868f4a2a6ff51690af39c7743c225480ea1fff4b2d7a7c466e5761f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	de63dfaf868f4a2a6ff51690af39c7743c225480ea1fff4b2d7a7c466e5761f7
SHA3-384 hash:	fbdc66a283dabdc6a44f2ae36075114bf746cc77ce7cdb6233be78832de740f56af31012ff93dce685cc9b68c27d72ac
SHA1 hash:	ea4acfb9efea4f064867f62493591423580d901c
MD5 hash:	7826f0c73202ea10bc6aa8ed48766350
humanhash:	one-echo-minnesota-seven
File name:	Loader v2.6.zip
Download:	download sample
File size:	79'931'112 bytes
First seen:	2026-10-13 06:59:41 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: infected
ssdeep	1572864:iygmE2YdB0hODEUmHMXfoUmEvrOCVC+TLzICq884jVBMEbn:ixVHVDrzrVBTZNB3n
TLSH	T1720833ED09F1CA9D34F9E9AE825D9B8634C8166571FEDB77C10383BAB0D3885D16848C
Magika	zip
Reporter	Ends0uls
Tags:	dropper-job fake-cheat file-pumped github pkg zip

Ends0uls

Fake game-cheat loader from GitHub (MajorRaikage45/MimiLokinil, linked from 362 StreetComptroller11 "<Game>-Cheats" repos). Adds Defender exclusions, drops a bot that connects to mops.to:408. Triage: https://tria.ge/261013-gktv1aaz6m

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: infected

This file archive contains 20 file(s), sorted by their relevance:

File name:	loader v2.6.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	117'302'034 bytes
SHA256 hash:	4c62ddac9be2c14466f1371198b1ad9dbfc37558fdf5361f5910b40c3cdf2d4b
MD5 hash:	938e839d1253093e94f5e7b19fd868c1
De-pumped file size:	57'440'768 bytes (Vs. original size of 117'302'034 bytes)
De-pumped SHA256 hash:	4ec631cbb54d6f2d47f8db3ad12e41ba2fe1b53291bf505177cb79c4aad8ce44
De-pumped MD5 hash:	5f3af18edca50bf0865ce79eae88f7a8
MIME type:	application/x-dosexec

File name:	save_state.json
File size:	2'643 bytes
SHA256 hash:	8f0227f7911c81f549c19883bd681858caac75bd68a34790febf032c9d3668d7
MD5 hash:	47d5e15b182692c9a0e705f453e03c78
MIME type:	text/plain

File name:	loader_manifest.dll
File size:	3'357 bytes
SHA256 hash:	2342f88fa9da167b30c477e73775fe3f871961ae897e4c8e00f4baab144534d1
MD5 hash:	e5989bfba758ed36d0e2300c48ace7d4
MIME type:	text/plain

File name:	physics_sim.dll
File size:	118 bytes
SHA256 hash:	eddd34fa5a2fef581078db5b3fe5c37d4fd1254407b4e6a8a2874190c1833b15
MD5 hash:	b5c7e71f7c661b3761eb8ae6e9767868
MIME type:	text/plain

File name:	render_engine.dll
File size:	188 bytes
SHA256 hash:	cf236158b58b673289056a1272fd799a042cb753b63715b1e98fdcf5a0e95f84
MD5 hash:	eb760b942d3c69ecc4488dc7d0a467ee
MIME type:	text/plain

File name:	loader_bootstrap.dll
File size:	126 bytes
SHA256 hash:	b5f36c1717dfd393d7dc078c3f329e6307f65fe3fcf705249e1bf8ea93e7a9e2
MD5 hash:	547e86aa8ee00e40502246146272e75f
MIME type:	text/plain

File name:	loader_inject.dll
File size:	125 bytes
SHA256 hash:	250b8c254667384025f7700370892de2bf32d9b9959ccebf86e2dafaae6973f1
MD5 hash:	afa09083e9f4483d9350b69ad42c54d0
MIME type:	text/plain

File name:	audio_mixer.dll
File size:	113 bytes
SHA256 hash:	2de12fd0908920ab0de69c60285e7004c2549d9954767de92fcfea03575d76cb
MD5 hash:	5d6500689a6b385ebab63c5353cce85c
MIME type:	text/plain

File name:	loader_03.json
File size:	1'946 bytes
SHA256 hash:	c3115985c946ca58b260f5da4712ad63b2edcb7e8a681eb9469621cb57e86590
MD5 hash:	37bbc2f71bf54b94df88704c088dc159
MIME type:	text/plain

File name:	settings.json
File size:	2'422 bytes
SHA256 hash:	a90ab00fad3c7399526d704ed0814f868fd8dd27774ec19557f8de624ad6271d
MD5 hash:	83002d1563b114fb3e853cdb0d554c4d
MIME type:	text/plain

File name:	save_encoder.dll
File size:	129 bytes
SHA256 hash:	d5fe7ebf57a545b0f402bc02f193b6c51797ec9647bad6a8be0e48b3230abbc9
MD5 hash:	5ee991fab0237405dff7c0e68e17c5db
MIME type:	text/plain

File name:	loader_02.json
File size:	3'215 bytes
SHA256 hash:	d95dcf7349c68edc53ce20449ba46b3df6f9cbbadeae28fba7c1b4e7c254b79a
MD5 hash:	7c073be25e025eec9a28d4cf5e8de2ad
MIME type:	text/plain

File name:	runtime_profile.json
File size:	3'731 bytes
SHA256 hash:	1ac39cb51c7fc1cc342fb2f568c3f378d625e9cb875329c872a6f3dbce23d5b0
MD5 hash:	3b3ac10ecb9ca27b02e740e79f5fc0ad
MIME type:	text/plain

File name:	core_math.dll
File size:	210 bytes
SHA256 hash:	f826c6ba306b3b8a36b8de28d0f483c0163e87d9f31eccc66d7be18c48c4f7de
MD5 hash:	01f307b9102d813d6359222dbced895f
MIME type:	text/plain

File name:	loader_config.dll
File size:	112 bytes
SHA256 hash:	52254e665371f8358437f0275b4d172b621db48c5959eb31a64020b9be6c9745
MD5 hash:	98bd5bd8cbdcd65091784ab6357b365d
MIME type:	text/plain

File name:	plugin_loader.dll
File size:	114 bytes
SHA256 hash:	7f5d15b199f3e4700aabccdd9d92a69fe14959443c69db83794e6dab43311290
MD5 hash:	87464548b55676a30b8496f441b44c1c
MIME type:	text/plain

File name:	loader_01.json
File size:	3'673 bytes
SHA256 hash:	773add2d258194cd9ff008b33473d7d61221f0570617098c4b6a5c79bacb4265
MD5 hash:	cbfdbe625ce9a0791aa1ce260b3862fb
MIME type:	text/plain

File name:	save_compressor.dll
File size:	122 bytes
SHA256 hash:	8f97aaa4bc9e93d9cf64b0528f35c827cdb1a3dfd3f58e10bcaad5f9cdca061b
MD5 hash:	4ad3af53f254618b4cae3945fee85514
MIME type:	text/plain

File name:	memory_pool.dll
File size:	121 bytes
SHA256 hash:	68c96d00121bb679bfa499eab24bd7a46d530b8ef376b45db805434b5e7b950e
MD5 hash:	ac9a5654830ca04472ed5eb177f7e3df
MIME type:	text/plain

File name:	threading_pool.dll
File size:	119 bytes
SHA256 hash:	74b87b3b6f1e266a3e1f7ae0e7bd25b8e880ed8313dd235613564ba4ac568651
MD5 hash:	70c2d3b50925d8d4b3b05c3a97160b7a
MIME type:	text/plain

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ec6cda51-d847-4edc-b6b9-52eb8dce00f3/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac0b83d4e97199d5892ac9f

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/de63dfaf868f4a2a6ff51690af39c7743c225480ea1fff4b2d7a7c466e5761f7

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/de63dfaf868f4a2a6ff51690af39c7743c225480ea1fff4b2d7a7c466e5761f7/results?tab=lookup

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/261013-kt566stzhx/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.