MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef865dc51fc91096f8cd25661e95bbe0597f49716d31d914fbccf6370a2a56fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gamaredon


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef865dc51fc91096f8cd25661e95bbe0597f49716d31d914fbccf6370a2a56fb
SHA3-384 hash: 0681d74f6730f93b6306763e085cb0f484f2d0b88c5448709de65206a1d4093d2220615809ea4a671496dc09756d4112
SHA1 hash: e4ec187e6d89d012fca22f79ea560c6ad180d17e
MD5 hash: 11e61a39988fb331a466b57a67971b31
humanhash: october-oranges-mobile-lithium
File name:2-3716-25_30.10.2025.rar
Download: download sample
Signature Gamaredon
Create hunting rule
File size:8'969 bytes
First seen:2025-12-30 12:07:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 192:YSmMCvmKDY5sI4KKApNSGlQ/iSJY7czZPM5th2c//fL:G7miW5N/GzhM3hb/b
TLSH T1F802AF0A652A5894E43E36EE0962254F8F2EEF8AF70E557F1643FA9CD1D48A3C019079
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter smica83
Tags:CVE-2025-6218 CVE-2025-8088 gamaredon rar UKR

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
HU HU
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:Перегляд підходів до призову під час мобілізації_2-3716-25_30.10.2025.pdf
File size:8'670 bytes
SHA256 hash: b9093d1c5b71c16a8a0473c12e41210bfba81c94a6365ef43ee87d0f8cb20fe6
MD5 hash: 85f8107a447d95e52b9403f59dcb29c3
MIME type:text/plain
Signature Gamaredon
File name:Перегляд підходів до призову під час мобілізації_2-3716-25_30.10.2025.pdf:.._.._.._.._.._.._AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Startup_2-3716-25_30.10.2025.HTA
File size:9'794 bytes
SHA256 hash: 846748912aa6e86b9d11f6779af6aae26b7258f8610d5e28eff0083779737824
MD5 hash: bc85cfda1e52dfdcee7a902e12dee5e6
MIME type:text/html
Signature Gamaredon
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/3e3f2dc5-3cc3-48ab-a34b-50935b8157f6/
Detection(s):
TwinWave.EvilRAR.GhettoSuperstream.20241120.UNOFFICIAL
Create hunting rule

TwinWave.EvilRAR.HongKongGarden_CVE-2025-8088.20250812.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6953c0b27d915bf1778f0041
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6953c0b02fb7bb52ca821015/reports/938cebe0-40c1-41a3-81cc-c123ed67ef19/overview
Verdict:
Malicious
Labled as:
CVE-2025-8088
Link:
https://www.hybrid-analysis.com/sample/ef865dc51fc91096f8cd25661e95bbe0597f49716d31d914fbccf6370a2a56fb
Verdict:
Malicious
File Type:
rar
First seen:
2025-12-30T08:48:00Z UTC
Last seen:
2025-12-30T11:48:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ef865dc51fc91096f8cd25661e95bbe0597f49716d31d914fbccf6370a2a56fb/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Rar Archive
Link:
https://app.malva.re/file/11e61a39988fb331a466b57a67971b31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef865dc51fc91096f8cd25661e95bbe0597f49716d31d914fbccf6370a2a56fb/
Threat name:
Binary.Trojan.Gamaredon
Create hunting rule
Status:
Malicious
First seen:
2025-12-30 12:08:18 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=56df3ri7zeijn6gnevtb5fn34bmx6slrnuy5sfh3zt3docrkk35q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ef865dc51fc91096f8cd25661e95bbe0597f49716d31d914fbccf6370a2a56fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:SUSP_RAR_NTFS_ADS
Create hunting rule
Author:Proofpoint
Description:Detects RAR archive with NTFS alternate data stream
Reference:https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats
Rule name:WinRAR_CVE_2025_8088_Exploit
Create hunting rule
Author:marcin@ulikowski.pl
Description:Detects RAR archives exploiting CVE-2025-8088 in WinRAR
Reference:https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments