MALICIOUS — 02625c2289914ee41210c8c10b776b57b795cfd24ae854503f638c188d775956.zip

MALICIOUS — 02625c2289914ee41210c8c10b776b57b795cfd24ae854503f638c188d775956.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 5 of 54 detection engines flagged it.

Identification

• SHA-256: 02625c2289914ee41210c8c10b776b57b795cfd24ae854503f638c188d775956
• SHA-1: fdf66512da6005dc51aba518a35a417a0ea4ec4d
• MD5: c4a68e944e4f7e1a7c2dade075e382d4
• ssdeep: 192:cnNOXydmw5h7khBb8WH/dPDX36ydznabJNFYlMW+/C1:cNOXyZ/mHFb3/ab3F+71
• TLSH: T1E121C0BC6549BA8EB889ACCDAC33707CB67A4186058C9DEC45A9F3044DCB5C76B8D444
• Submitted as: 02625c2289914ee41210c8c10b776b57b795cfd24ae854503f638c188d775956.zip
• File type: zip · Size: 9368 bytes
• Verdict: malicious (89/100)

Source: MalwareBazaar · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (5 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Zip_jpg.UNOFFICIAL
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): Trojan.GenericKD.81020675
• Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen

Why this verdict

The malicious score of 89/100 is the fusion of 3 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Zip_jpg.UNOFFICIAL (rule Sanesecurity.Foxhole.Zip_jpg.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: IMG_20260803_024632.jpg.lnk - static signal, weight 0.25, confidence 0.50

Archive contents (1 executable)

This zip carries 1 extracted member, each analyzed as its own sample:

• IMG_20260803_024632.jpg.lnk - 8dd820ade18787e81109f0baf13b1131b44e443ffba74e1704d68eaf30df40b4

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report