URLhaus-PL-3d7f560c0547cf77e5184eafdd5bf2a07bf28783c7019fb9db2e923f4c78ab44
medium
📛 Threat Title
URLhaus payload: (bat) 3d7f560c0547cf77…
Description
File type: bat. Size: 13,345,633 bytes. First seen: 2026-11-03 02:39:04.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
3d7f560c0547cf77e5184eafdd5bf2a07bf28783c7019fb9db2e923f4c78ab44
IOC database
- Type
- hash_sha256
- Value
3d7f560c0547cf77e5184eafdd5bf2a07bf28783c7019fb9db2e923f4c78ab44- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URLhaus payload hash
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
3fae0f285b5159a0303f297c059caeba
IOC database
- Type
- hash_md5
- Value
3fae0f285b5159a0303f297c059caeba- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URLhaus payload hash
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_ssdeep
49152:gyjzb1zf1ashb/lcg17d1wxhq1+dxnsstwu5ju2wrtmbgs4as+hq8jxk9pxyhdzi:1
IOC database
- Type
- hash_ssdeep
- Value
49152:gyjzb1zf1ashb/lcg17d1wxhq1+dxnsstwu5ju2wrtmbgs4as+hq8jxk9pxyhdzi:1- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- ssdeep of URLhaus payload 3d7f560c0547cf77…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_tlsh
t183d69c322603bcfa3f6e6ec599142d404c4d3d974254c9a4be4ef8b3a6de1486fae4
IOC database
- Type
- hash_tlsh
- Value
t183d69c322603bcfa3f6e6ec599142d404c4d3d974254c9a4be4ef8b3a6de1486fae4- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- TLSH of URLhaus payload 3d7f560c0547cf77…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Download sample (ZIP, password: infected) URLhaus
- URLhaus payload page URLhaus
Remediations (10)
-
web:darkwebinformer.com
A suspicious GitHub-hosted ZIP file has been identified as part of a payload delivery campaign. The file is associated with SmartLoader activity and was submitted to URLHaus .
-
web:docs.lodol.com
Check links, domains and files against URLhaus , abuse.ch's database of websites that spread malware: find out whether a URL is known malware and still online, what a domain or IP address has served, which files a URL dropped and which URLs served a file. Look up tags and malware families, and pull the newest malware URLs and payloads for a blocklist. Needs a free abuse.ch Auth-Key.
-
web:docs.spamhaus.com
A payload gets observed in combination with a URL tracked by URLhaus ; The information on a payload changes for a URL tracked by URLhaus (e.g. malware family associated with a payload ). URL Additions This message gets triggered when a new URL gets reported (and subsequently added) to the URLhaus database. The message has the following format:
-
web:docs.tracecat.com
Reference for the Tracecat URLhaus integration: registered actions, required secrets, expected inputs, and example workflow usage.
-
web:github.com
Beside the APIs documented on URLhaus that serves various feeds and lists, abuse.ch also offers a dedicated API that allows to gather information on a specific URL, file hash or host from URLhaus through an automated way. It is also possible to retrieve a payload (malware sample) URLhaus has collected from malware URLs it tracks.
-
web:netguide.io
Filter list covering malware. Format: URLs. Maintained by abuse.ch. See the project homepage for details and inclusion criteria. 73.4k entries, updated 1 week ago.
-
web:pipeworx.io
Look up a malware payload file by its MD5 or SHA256 hash in the URLhaus database. Returns file type, size, first/last seen dates, and associated delivery URLs.
-
web:urlhaus.abuse.ch
URLhaus Database URLhaus tries to identify the malware associated with the payload served by a certain malware URL. In case URLhaus is able to identify the associated malware family, the payload will be tagged accordingly (field signature). The page below gives you an overview on payloads that URLhaus has identified as BitRAT. Database Entry
-
web:urlhaus.abuse.ch
URLhaus Database Malware URLs on URLhaus are usually associated with certain tags. Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with payloads . Database Entry
-
web:www.microsoft.com
On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to the Python Package Index (PyPI) and distributed through official container images. The malicious package added files that Python could execute during normal interpreter initialization. An application did not need to import LiteLLM for the payload to run: starting Python in an affected environment could be enough ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.