MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 6 File information Comments 1

SHA256 hash:	fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d
SHA3-384 hash:	c929349db1ef16ea54396cb2ae4bb699edd6bbc314592cc69170bd0eb1985c4bad2fdc440a166ae200f84d37d6c9dad0
SHA1 hash:	b4e650340077519842773626b4b1c3760964eb28
MD5 hash:	faa2e02a0bfc9a94117cb4cd5f281829
humanhash:	blue-wisconsin-maryland-leopard
File name:	photo_287742060718.zip
Download:	download sample
Signature	PureRAT Create hunting rule
File size:	1'168 bytes
First seen:	2026-08-04 22:18:55 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24:9EBVgbtW/x6/7eco5ILyuIhzyAG7ouxj9VkvhSqXhubSuRzSrf1C0pQ/FiV+oLel:9dJWk/7Ro5KN7ouxjcjxuJzSrf1CpFQ6
TLSH	T1D2219650DAE40A20DEC6977D267D1FA011646528BC0FDBDBB8060247A76374D1BC3D16
Magika	zip
Reporter	k3dg3___
Tags:	PureRAT zgRAT zip

k3dg3

Booking themed Lures
leads to https://bazaar.abuse.ch/sample/6941fbafdf1c7e5ddd12b9050c27501aba8b0ab05e1916afffd21ba30257ebf8/

zgRAT SSL Variant (PureRAT)
C2_Encryption_Algorithm: SSL
C2: v0hkpadr04mbz5lkearqa.com:56001
C2: v0hkpadr04mbz5lkearqa.com:56002
C2: v0hkpadr04mbz5lkearqa.com:56003
C2: 0zbqnac1t4dv2t2wuodv1m.com:56001
C2: 0zbqnac1t4dv2t2wuodv1m.com:56002
C2: 0zbqnac1t4dv2t2wuodv1m.com:56003
C2: 85.239.149.178:56001
C2: 85.239.149.178:56002
C2: 85.239.149.178:56003
Version: 4.4.3
Group: syka2
Mutex: Tljqrvsyd

Intelligence

File Origin

# of uploads :

# of downloads :

215

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	VID_036325290078.mp4
File size:	1'792 bytes
SHA256 hash:	6db2e75abdcac6ddfbea14a89c03f1ce8a7153eede3931dd1bae01d473dbe2ba
MD5 hash:	0a91be54197760c712f829d70eb2eb1e
MIME type:	application/octet-stream
Signature	PureRAT

File name:	photo_287742060718.lnk
File size:	2'690 bytes
SHA256 hash:	3764f4b259a72b12422956f553eba62edc7a0b21cf628e839d24150e701e0a69
MD5 hash:	d2e89641aab3f2c1790dcad746aa67b8
MIME type:	application/octet-stream
Signature	PureRAT

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5454f760-bd70-45da-ba33-92899dd12842/

Detection(s):

Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL

TwinWave.EvilLNK.PShellEncoderGamesTheMessage.20220523.UNOFFICIAL

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL

TwinWave.EvilLNK.KingForADaypshell.20231121.UNOFFICIAL

SecuriteInfo.com.Zip.LNK-1.UNOFFICIAL

YARA.SIGNATURE_BASE_SUSP_ZIP_LNK_Phishattachment_Pattern_Jun22_1.UNOFFICIAL

Result

Verdict:

Malicious

File Type:

LNK File - Malicious

Link:

https://app.docguard.net/fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

explorer lolbin

Link:

https://www.filescan.io/uploads/6a72656f8650235216a9d7bb/reports/d59892dc-a4f7-44c7-9c74-69641746dcd0/overview

Verdict:

Suspicious

Labled as:

Troj/LnkRun

Link:

https://www.hybrid-analysis.com/sample/fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d

Verdict:

Malicious

File Type:

zip

First seen:

2026-08-04T20:24:00Z UTC

Last seen:

2026-08-06T00:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d/results?tab=lookup

Verdict:

Malware

YARA:

3 match(es)

Tags:

Batch Command Execution: CMD in LNK Execution: PowerShell in LNK LNK LOLBin LOLBin:powershell.exe Malicious PowerShell PowerShell Call T1059.001 T1059.003 T1202: Indirect Command Execution T1204.002 Zip Archive

Link:

https://app.malva.re/file/faa2e02a0bfc9a94117cb4cd5f281829

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d/

Threat name:

Win32.Trojan.Sonbokli

Status:

Malicious

First seen:

2026-08-04 22:19:30 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

3 of 24 (12.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=72bho4cvjeze3d63stgh3guqqmmq6put5ds573cyfnnpuxkczf6q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PS_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies PowerShell artefacts in shortcut (LNK) files.

Rule name:	SUSP_LNK_PowerShell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference to powershell inside an lnk file, which is suspicious

Rule name:	SUSP_ZIP_LNK_PhishAttachment Create hunting rule
Author:	ignacior
Description:	Detects suspicius tiny ZIP files with malicious lnk files
Reference:	Internal Research

Rule name:	SUSP_ZIP_LNK_PhishAttachment_Pattern_Jun22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious tiny ZIP files with phishing attachment characteristics
Reference:	Internal Research