Malicious Rar Archive analysis – 2fcb530e9fc9

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Rar archive

Size

11.27 MB · 11,273,475 B

First seen

2026-10-16 04:45 · 9 days ago

Last seen

2026-10-16 04:45 · 9 days ago

Last analysis

2026-10-16 04:46 · 9 days ago

Hashes

MD5 cd43a6913acedce67511e5f1118eeb93 Sha1 bdb50571a445bb5cc3d0526b99c2d2f8a4fe9fd4 Sha256 2fcb530e9fc950da8f43f38beb90beb63b26730f53b7e954b3813fe213ccd060 Sha384 91d3fef37fc99bd795c577d4ee9eec46c671f9543b0e56df22d7690a1eacad20df816da088741f972e8c4de9a64bf860 Sha512 0af780c525537a349c912369d5fc7537dbe03aba7dc1cf925aea80ec412d6dc982892a7907cc2597c07a44eff0186ce7b4b2aa0bb91583f5bb82710797eaee9b SSDeep 196608:JNat5ZGfGOSMKFP9QDk/CKC5NqOxd4/9rt6BSQ1Fd4EyVm:Jct5Z6G1MKFP+I//C5N34FroSQf+Eyc TLSH E2B633B7E07BC1D84AEC1A04F25995A040A01DA9D0731C26F317AB59BBE0BF70D6677E

6 malicious · 809 files

RARcd43a6913acedce67511e5f1118eeb93

JSONconfig.json

PYconfig.py

PYmain.py

TXTrequirements.txt

PS1run.bat

PS1[Deobfuscated PS]

SHrun.sh

BIN__pycache__

BINactions

BINrelease

BINruntime

BINdata

ZIPcache.db

BIN.build_id

TXTLICENSE.txt

EXE_asyncio.pyd

EXE_bz2.pyd

EXE_ctypes.pyd

EXE_decimal.pyd

EXE_elementtree.pyd

EXE_hashlib.pyd

EXE_lzma.pyd

EXE_msi.pyd

EXE_multiprocessing.pyd

EXE_overlapped.pyd

EXE_queue.pyd

EXE_socket.pyd

EXE_sqlite3.pyd

EXE_ssl.pyd

EXE_uuid.pyd

EXE_zoneinfo.pyd

DLLlibcrypto-3.dll

DLLlibffi-8.dll

DLLlibssl-3.dll

EXEpyexpat.pyd

CATpython.cat

EXEpython.exe

DLLpython3.dll

_PTHpython311._pth

DLLpython311.dll

ZIPpython311.zip

PYCabc.pyc

PYCaifc.pyc

PYCantigravity.pyc

PYCargparse.pyc

PYCast.pyc

PYCasynchat.pyc

PYCasyncore.pyc

PYCbase64.pyc

PYCbdb.pyc

PYCbisect.pyc

PYCbz2.pyc

PYCcalendar.pyc

PYCcgi.pyc

PYCcgitb.pyc

PYCchunk.pyc

PYCcmd.pyc

PYCcode.pyc

PYCcodecs.pyc

PYCcodeop.pyc

PYCcolorsys.pyc

PYCcompileall.pyc

PYCconfigparser.pyc

PYCcontextlib.pyc

PYCcontextvars.pyc

PYCcopy.pyc

PYCcopyreg.pyc

PYCcProfile.pyc

PYCcrypt.pyc

PYCcsv.pyc

PYCdataclasses.pyc

PYCdatetime.pyc

PYCdecimal.pyc

PYCdifflib.pyc

PYCdis.pyc

PYCdoctest.pyc

PYCenum.pyc

PYCfilecmp.pyc

PYCfileinput.pyc

PYCfnmatch.pyc

PYCfractions.pyc

PYCftplib.pyc

PYCfunctools.pyc

PYCgenericpath.pyc

PYCgetopt.pyc

PYCgetpass.pyc

PYCgettext.pyc

PYCglob.pyc

PYCgraphlib.pyc

PYCgzip.pyc

PYChashlib.pyc

PYCheapq.pyc

PYChmac.pyc

PYCimaplib.pyc

PYCimghdr.pyc

PYCimp.pyc

PYCinspect.pyc

PYCio.pyc

PYCipaddress.pyc

PYCkeyword.pyc

PYClinecache.pyc

PYClocale.pyc

PYClzma.pyc

PYCmailbox.pyc

PYCmailcap.pyc

PYCmimetypes.pyc

PYCmodulefinder.pyc

PYCnetrc.pyc

PYCnntplib.pyc

PYCntpath.pyc

PYCnturl2path.pyc

PYCnumbers.pyc

PYCopcode.pyc

PYCoperator.pyc

PYCoptparse.pyc

PYCos.pyc

PYCpathlib.pyc

PYCpdb.pyc

PYCpickle.pyc

PYCpickletools.pyc

PYCpipes.pyc

PYCpkgutil.pyc

PYCplatform.pyc

PYCplistlib.pyc

PYCpoplib.pyc

PYCposixpath.pyc

PYCpprint.pyc

PYCprofile.pyc

PYCpstats.pyc

PYCpty.pyc

PYCpyclbr.pyc

PYCpydoc.pyc

PYCpy_compile.pyc

PYCqueue.pyc

PYCquopri.pyc

PYCrandom.pyc

PYCreprlib.pyc

PYCrlcompleter.pyc

PYCrunpy.pyc

PYCsched.pyc

PYCsecrets.pyc

PYCselectors.pyc

PYCshelve.pyc

PYCshlex.pyc

PYCshutil.pyc

PYCsignal.pyc

PYCsite.pyc

PYCsmtpd.pyc

PYCsmtplib.pyc

PYCsndhdr.pyc

PYCsocket.pyc

PYCsocketserver.pyc

PYCsre_compile.pyc

PYCsre_constants.pyc

PYCsre_parse.pyc

PYCssl.pyc

PYCstat.pyc

PYCstatistics.pyc

PYCstring.pyc

PYCstringprep.pyc

PYCstruct.pyc

PYCsubprocess.pyc

PYCsunau.pyc

PYCsymtable.pyc

PYCsysconfig.pyc

PYCtabnanny.pyc

PYCtarfile.pyc

PYCtelnetlib.pyc

PYCtempfile.pyc

PYCtextwrap.pyc

PYCthis.pyc

PYCthreading.pyc

PYCtimeit.pyc

PYCtoken.pyc

PYCtokenize.pyc

PYCtrace.pyc

PYCtraceback.pyc

PYCtracemalloc.pyc

PYCtty.pyc

PYCtypes.pyc

PYCtyping.pyc

PYCuu.pyc

PYCuuid.pyc

PYCwarnings.pyc

PYCwave.pyc

PYCweakref.pyc

PYCwebbrowser.pyc

PYCxdrlib.pyc

PYCzipapp.pyc

PYCzipfile.pyc

PYCzipimport.pyc

PYC_aix_support.pyc

PYC_bootsubprocess.pyc

PYC_collections_abc.pyc

PYC_compat_pickle.pyc

PYC_compression.pyc

PYC_markupbase.pyc

PYC_osx_support.pyc

PYC_pydecimal.pyc

PYC_pyio.pyc

PYC_py_abc.pyc

PYC_sitebuiltins.pyc

PYC_strptime.pyc

PYC_threading_local.pyc

PYC_weakrefset.pyc

PYC__future__.pyc

PYC__hello__.pyc

BINasyncio

BINcollections

BINconcurrent

BINctypes

BINcurses

BINdbm

BINdistutils

BINemail

BINencodings

BINhtml

BINhttp

BINimportlib

BINjson

BINlib2to3

BINlogging

BINmsilib

BINmultiprocessing

BINpydoc_data

VBStopics.pyc

CSS_pydoc.css

PYC__init__.pyc

BINre

BINsite-packages

BINsqlite3

BINtomllib

BINunittest

BINurllib

BINwsgiref

BINxml

BINxmlrpc

BINzoneinfo

BIN__phello__

EXEpythonw.exe

EXEselect.pyd

DLLsqlite3.dll

EXEunicodedata.pyd

DLLvcruntime140.dll

DLLvcruntime140_1.dll

EXEwinsound.pyd

PYenv.py

PYexecutor.py

PYsecurity.py

PYsession.py

PYui.py

PS1__init__.py

BIN__pycache__

BIN.gitignore

PYbot_actions.py

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 13 STICH kept: 5secondary ignored: 8

bin 7img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

5 / 5

Path arc:rar>scr:ps1~T1027~T1059.001

Shape arc:rar>scr:ps1

malicious 2 nodes

Path arc:rar>arc:zip>arc:zip>scr:vbs~T1059.005

Shape arc:rar>arc:zip>arc:zip>scr:vbs

technique4 nodes

Deobfuscated PowerShell UNKNWOWNmalicious

@echo huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential