MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbaf5848fd907870000b57a97cc3fad8045ae3d237b016a48067d2f22a8206aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	fbaf5848fd907870000b57a97cc3fad8045ae3d237b016a48067d2f22a8206aa
SHA3-384 hash:	360fcd9deb4b1a5f3668f5d66b84bf53d3de65763af9a9a02b61801b59dd5599631d052f98a8bab5255afcf514230e73
SHA1 hash:	3068bef63e9f47d725b1984181232ecdad4e4ee2
MD5 hash:	acc2bcefe32210964a87d259ace34ae0
humanhash:	carolina-item-harry-seventeen
File name:	stage2.cab
Download:	download sample
File size:	23'070'087 bytes
First seen:	2026-10-15 17:18:12 UTC
Last seen:	Never
File type:	cab
MIME type:	application/vnd.ms-cab-compressed
ssdeep	393216:yhSgSCTKJAAJJk8a77dfnbFt84b21mWa6yhy9u5g8d2NY4DL+xQ:l35l8P77dPBG4kmCCdUzDqxQ
TLSH	T1B6373312DF0587D9AA637DFBB6A2B6A4482CAC2173D743D7AF84964D213374762B3C01
Magika	cab
Reporter	devmihaylov
Tags:	cab RAT socketio Stage2

devmihaylov

Second stage of IMG_958742253158.scr, served from msvci[.]com/files/.ini behind a CabAgent/1.0 user agent and an X-CAB-Key header, with the 32 leading and 100 inner junk bytes already removed so this is the clean MSCF cabinet the dropper unpacks. Holds a full Python 3.9 runtime whose winsec.exe is the genuine python.org pythonw, the malicious part is Lib/site-packages/sitecustomize.py plus the pycached package, a Socket.IO RAT that checks in to g.obrn[.]cc and uploads desktop screenshots.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/423d963e-491f-467a-a207-bbc1310b9f2f/

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad1a8716f551121ba1676e3

Tags:

injection obfusc

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fbaf5848fd907870000b57a97cc3fad8045ae3d237b016a48067d2f22a8206aa

Verdict:

Clean

File Type:

cab

Link:

https://opentip.kaspersky.com/fbaf5848fd907870000b57a97cc3fad8045ae3d237b016a48067d2f22a8206aa/results?tab=lookup

Score:

32%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery evasion pdf

Link:

https://tria.ge/reports/261015-wybznsbw5n/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.76

Link:

https://yomi.yoroi.company/submissions/fbaf5848fd907870000b57a97cc3fad8045ae3d237b016a48067d2f22a8206aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)