MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa29d870ac0a326e209d2fe51084955614c86606a6b224e3ece2b8ea73a4d6d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fa29d870ac0a326e209d2fe51084955614c86606a6b224e3ece2b8ea73a4d6d6
SHA3-384 hash:	797bae3805d82afe88e537ec44068a2ee714181b2511d5092ee82a13fdea3b19db2e3af08738e33702419070c00c5551
SHA1 hash:	d22b326eda9058939e9620f7245162f853096923
MD5 hash:	701e43b90402e7d598587021e7fa4f2c
humanhash:	maine-cardinal-kansas-minnesota
File name:	logger
Download:	download sample
File size:	91'047'945 bytes
First seen:	2026-02-02 18:10:30 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1572864:v2YxI4xxtIhf2byZw25/L1eV01S2IaCWZDYt8OB/ZKp1CaQQhWWJojgF0d73jSf7:+KI4xMlRw2/I3025B/sp1CQh9O8+REoI
TLSH	T1971833487D22359EFE3D9430C4585274E760012945B6ACF68A2E22E335D3BCB4B79B7E
Magika	zip
Reporter	monitorsg
Tags:	SmartApeSG zip

monitorsg

hXXps://tiapolif[.]com/tenant/redirect-effect.php --> hXXps://tiapolif[.]com/tenant/dashboard-thread.js (clickfix) --> hXXp://193[.]111.208.17/metrics (HTA) --> hXXps://verotibet[.]com/metrics (HTA) --> hXXps://193[.]111.208.17/logger (ZIP)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

119

Origin country :

US

Vendor Threat Intelligence

ACCE

Gathering data

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6980e8bc0bdf9fb6cc09644f

Tags:

n/a

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fa29d870ac0a326e209d2fe51084955614c86606a6b224e3ece2b8ea73a4d6d6

InQuest SUSPICIOUS

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/fa29d870ac0a326e209d2fe51084955614c86606a6b224e3ece2b8ea73a4d6d6

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

zip

Link:

https://opentip.kaspersky.com/fa29d870ac0a326e209d2fe51084955614c86606a6b224e3ece2b8ea73a4d6d6/results?tab=lookup

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/fa29d870ac0a326e209d2fe51084955614c86606a6b224e3ece2b8ea73a4d6d6

CERT.PL MWDB

Gathering data

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/fa29d870ac0a326e209d2fe51084955614c86606a6b224e3ece2b8ea73a4d6d6

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7iu5q4fmbizg4ie5f7srbbevkykmqzqgu2zcjy7m4k4ou45e23la._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.