MB-fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d
high
📛 Threat Title
Unknown: photo_287742060718.zip
Description
File type: zip. Size: 1168 bytes. Tags: PureRAT, zgRAT, zip. Reporter: k3dg3. First seen: 2026-08-04 22:18:55.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d
IOC database
- Type
- hash_sha256
- Value
fe8277705549324d8fdb94cc7d9a9083190f3e93e8e5dfec582b5afa5d42c97d- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
b4e650340077519842773626b4b1c3760964eb28
IOC database
- Type
- hash_sha1
- Value
b4e650340077519842773626b4b1c3760964eb28- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
faa2e02a0bfc9a94117cb4cd5f281829
IOC database
- Type
- hash_md5
- Value
faa2e02a0bfc9a94117cb4cd5f281829- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: zip. Size: 1168 bytes. Tags: PureRAT, zgRAT, zip. Reporter: k3dg3. First seen: 2026-08-04 22:18:55.
Remediations (10)
-
web:cyberreplay.com
This guidance focuses on 7-zip rce mitigation and practical steps that reduce the attack surface quickly. For hands-on support to run a focused 24-72 hour remediation plan, choose a next step now: Book a free security assessment, Schedule a 15-minute intake, or Request managed response.
-
web:learn.microsoft.com
The most common cause is a detected threat in a downloaded file, but it can also be an installed program. Click on the Windows Security icon in the system tray. Click on Virus & threat protection > Protection history to see the Remediation incomplete detection and location of the file.
-
web:learn.microsoft.com
Remediation actions can include removing a file, sending it to quarantine, or allowing it to remain. This article includes information and links to resources about specifying what actions should be taken when threats are detected on devices. You can choose from several methods, such as: Configure remediation for Microsoft Defender Antivirus ...
-
web:piunikaweb.com
Google has fixed a Google Photos bug that corrupted ZIP downloads larger than 4GB on desktop, and affected users can now re-download files or use a repair tool.
-
web:socprime.com
An active multi-stage intrusion campaign is targeting the hospitality sector through photo-themed ZIP archives that contain malicious LNK files. The infection chain uses obfuscated PowerShell decoders, on-the-fly .NET DLL compilation, and a Node.js-based implant for persistence and command-and-control communication.
-
web:support.google.com
What Happened. We recently identified a bug that affected users who used the Google One Storage Manager on a computer to download their Google Photos content. For archives larger than 4GB generated by this tool, ZIP files were created incorrectly and could not be opened.
-
web:www.majorgeeks.com
Windows Defender may try to remove a virus, trojan, or other malware and return a message stating Remediation incomplete. Remediation incomplete leads one to assume that a virus, trojan or malware was found, but not removed.
-
web:www.microsoft.com
Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia. The campaign uses photo-themed ZIP archives and fake image shortcut files to deliver a persistent Node.js implant and evade detection.
-
web:www.reddit.com
How Do I Fix " Remediation Incomplete"? I recently downloaded a trojan by accident a couple of days ago and when i ran window defender, this showed up. I did multiple quick scans on malwarebytes and 2 full scans (both i manually canceled because they were taking too long, 8 hours for one and 1 full day for the other) and nothing came up.
-
web:www.vicarius.io
The CVE-2025-0411 vulnerability in 7-Zip allows attackers to open and execute files inside archives without preserving the Mark-of-the-Web (MOTW) flag, potentially bypassing security restrictions. Since 7-Zip does not enforce MOTW, files extracted from an archive may execute without SmartScreen warnings, increasing the risk of exploitation.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.