Suspicious
Suspect

3a65514298122a157e97c06eaf1d3856

ZIP Archive
MD5: 3a65514298122a157e97c06eaf1d3856
Size: 24.65 MB
application/zip

This sample is a 23.5 MB ZIP Archive. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 7 embedded or derived files. It matches 2 YARA rules. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
2767b4ed29f2ffd74f9efbafc0e7faf8a1b37353c286c24a423e5f1a2458e851
MD5
3a65514298122a157e97c06eaf1d3856
Verdict
No known threat found
File type
ZIP Archive · 23.5 MB

Cite this report: https://app.malva.re/sha256/2767b4ed29f2ffd74f9efbafc0e7faf8a1b37353c286c24a423e5f1a2458e851

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive
Size
24.65 MB · 24,654,599 B
First seen
2026-09-19 06:00 · one month ago
Last seen
2026-09-19 06:00 · one month ago
Last analysis
2026-09-19 06:00 · one month ago
Hashes
MD5 3a65514298122a157e97c06eaf1d3856 Sha1 1019b9ecc91a3a5e430093eaccf4f64983c2cf98 Sha256 2767b4ed29f2ffd74f9efbafc0e7faf8a1b37353c286c24a423e5f1a2458e851 Sha384 68e967c5e9e3df7aa6a2600827eb2e9c47ada865c98a252f320dd33c841538ef039d178b2ca9d9bbca9e03fa6561971f Sha512 f6af859a7aab3216da24e7df41b062e3cc920f83d9aa19e71228fe2e7b0d3ccd7c228972fc38d074028faa8a28eb73adeab896aef330aa600ea29c27429e5ef9 SSDeep 393216:JeF0sUdUG2b+ShUP9OpCtsUn7o806BB5EHemTSmODa/FFwMjlA6retsdeUzxX+gU:8F0pJ2KShUP9OY267ouBaHemTE066msC TLSH 1047339F8EB7DF4643F85A0AB544CDAFB39B788E0076F37E8BA6633541449CA7111908

8 files
ZIP3a65514298122a157e97c06eaf1d3856
EXEkrig-miner.exe
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BATStart-Pearl.bat
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

8 files
ZIP3a65514298122a157e97c06eaf1d3856
BATStart-Pearl.bat
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙