MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3d1aa310773e97c7b36b720c555c52dac09f3904177c75da367b0f0e51dc2fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3d1aa310773e97c7b36b720c555c52dac09f3904177c75da367b0f0e51dc2fe
SHA3-384 hash: 2c81449ce278aa9ac28b0b43aa47952ea96d02037e834534ea0139a679dd8d98904bca70a8ca06b65aed94cb9195cfb3
SHA1 hash: 6cd6d5d5e71254c2a03c02c04e936e66668d1937
MD5 hash: 44e7411bbf42e816004b9839b314696e
humanhash: fix-ohio-jig-equal
File name:e.zip
Download: download sample
File size:8'072'730 bytes
First seen:2026-01-18 18:29:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:FPYGvlt3ah11Irw0yzQiDO+lSnTjdCibVZL/Lf+9/fIy0G:CuS11T0yzPDOLThCiRZLTf8Ay0G
TLSH T1BE86338628AE74BDBD5BF7A33688742C4C62A309F14C136DA8CDED6DEB66701758C131
Magika zip
Reporter Anonymous
Tags:exe pyinstaller Ransomware windows zip


Avatar
Anonymous
Found on discord.

Intelligence

File Origin
# of uploads :
1
# of downloads :
474
Origin country :
TR TR
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:HCR2Ransomware.exe
File size:8'017'282 bytes
SHA256 hash: 611fa075c5f56b43dfec94bf0f8fffa31665d0572e0a3ddab5d7c7a28396d7bc
MD5 hash: 1ca1d6c06b007c726caf139d794a5481
MIME type:application/x-dosexec
File name:side.png
File size:136'249 bytes
SHA256 hash: 4889f49a5ab05ce1a6ed6380d73048377d8427105ba3fb11fa0b1c125c6ff589
MD5 hash: d151759bc8cca8dcae970a0eb8000711
MIME type:image/png
File name:background.png
File size:127'030 bytes
SHA256 hash: 1d73e241514eb04346888d325ef6939947a51c8cd0f25b52565bd5a8f29932fe
MD5 hash: b69a12e0483febc537dbae7ff43b8fcb
MIME type:image/png
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/80d9bb40-a44f-465b-882b-2199603b6bb5/
Detection(s):
SecuriteInfo.com.PyInstaller.13124.17635.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=696d26d8f3cf908ba5062c42
Tags:
installer injection extens bazar
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/e3d1aa310773e97c7b36b720c555c52dac09f3904177c75da367b0f0e51dc2fe/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
expand installer-heuristic lolbin microsoft_visual_cc overlay overlay packed packed pyinstaller pyinstaller
Link:
https://www.filescan.io/uploads/696d26cf584f1963ad5a3856/reports/b643f299-7ac1-49c7-a580-5e6201cc2b8c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e3d1aa310773e97c7b36b720c555c52dac09f3904177c75da367b0f0e51dc2fe
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e3d1aa310773e97c7b36b720c555c52dac09f3904177c75da367b0f0e51dc2fe
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
zip
First seen:
2026-01-18T16:19:00Z UTC
Last seen:
2026-01-18T18:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e3d1aa310773e97c7b36b720c555c52dac09f3904177c75da367b0f0e51dc2fe/results?tab=lookup
Score:
90%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/e3d1aa310773e97c7b36b720c555c52dac09f3904177c75da367b0f0e51dc2fe
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/44e7411bbf42e816004b9839b314696e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3d1aa310773e97c7b36b720c555c52dac09f3904177c75da367b0f0e51dc2fe/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-01-18 18:30:46 UTC
File Type:
Binary (Archive)
Extracted files:
1576
AV detection:
10 of 38 (26.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4pi2umihopuxy6zww4qmkvoffwwat44qif34oxndm6ypbzi5yl7a._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
pyinstaller ransomware
Link:
https://tria.ge/reports/260118-w6vfzsc19h/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Renames multiple (161) files with added filename extension
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip e3d1aa310773e97c7b36b720c555c52dac09f3904177c75da367b0f0e51dc2fe

(this sample)

611fa075c5f56b43dfec94bf0f8fffa31665d0572e0a3ddab5d7c7a28396d7bc

  
Link
https://tria.ge/260118-wz5clscz7h/behavioral3
  
Dropping
MD5 1ca1d6c06b007c726caf139d794a5481
  
Dropping
SHA256 611fa075c5f56b43dfec94bf0f8fffa31665d0572e0a3ddab5d7c7a28396d7bc
  
Delivery method
Distributed via web download

Comments