MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2049b7b8b9677fe80a01eb65c3b014e453ba53ce53b031899e70e5aafdedd23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f2049b7b8b9677fe80a01eb65c3b014e453ba53ce53b031899e70e5aafdedd23
SHA3-384 hash:	054762456a0825943069ff0b82700795ac1ed444fed2f7ec90c75b47ba48ae0dd93feda55c118fe78eaf43731f289eb5
SHA1 hash:	981c406c5413977aad967be9b7056f625412d273
MD5 hash:	95406f3792725050696257242a3dc63b
humanhash:	mango-nuts-carpet-orange
File name:	recuva_professional__technician_(2026)_full_español_[mega].7z
Download:	download sample
File size:	4'126'339 bytes
First seen:	2026-08-25 19:26:00 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	98304:nhBLmBhcgxPrvkXNsJR13PucNgBSd54ogR7mTQy1Jzt0+L:nhZScgx76WR1gUd54o4mTQy36k
TLSH	T17716333AD06ED4CA1B3A68203994CB3E2316D95BC62D5847DA0CE1EDDF4F8D363B5252
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	7z file-pumped pw-2805 RemusStealer

iamaachum

https://pulse.bytecorestream4.lol/Recuva_Professional__Technician_(2026)_Full_Espa%C3%B1ol_%5BMega%5D.zip

RemusStealer C2:
http://cryptovectorhub3.lol:5478/customers
http://fresok.top:9048/posts
http://shhsift.click:7647/webhooks

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

38

Origin country :

ES

Vendor Threat Intelligence

ACCE Unknown

No detections

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f2049b7b8b9677fe80a01eb65c3b014e453ba53ce53b031899e70e5aafdedd23

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

SFX 7z

Link:

https://app.malva.re/file/95406f3792725050696257242a3dc63b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f2049b7b8b9677fe80a01eb65c3b014e453ba53ce53b031899e70e5aafdedd23/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6icjw64lsz375afad23fyoybjzctxjj44u5qggez44hfvl663urq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.