ThreatFox IOC Database
You are viewing the ThreatFox database entry for sha256_hash bd3997c44f1820eccc6574ee003bf5319b6a27d28e782937271c6ae190af024d.
Database Entry
| IOC ID: | 1785148 |
|---|---|
| IOC: | bd3997c44f1820eccc6574ee003bf5319b6a27d28e782937271c6ae190af024d |
| IOC Type : | sha256_hash |
| Threat Type : | payload |
| Malware: | Unknown RAT |
| Confidence Level : | Confidence level is elevated (75%) |
| Is compromised? : | False |
| First seen: | 2026-04-13 12:58:21 UTC |
| Last seen: | never |
| UUID: | 0a29f4ef-372f-11f1-8759-42010aa4000a |
| Reporter |  Omaha |
| Reward | 5 credits from ThreatFox |
| Tags: | BYOR fake-game infostealer java RAT ZKM-Stealer |
| Reference: | https://tria.ge/260407-s8dpgahs5l/behavioral1 |
Omaha
SHA256 hashes for (malware that self identifies in its files as)ZKM Stealer 26.0.0 components.
Java-based infostealer and RAT distributed via social
engineering using fake game applications.
SHA256: b4a7989bbe6d62951b93a33515f6690dab161e226aaae820ee6d9b086836d433
File: update.jar - main Java payload
MD5: 71d8a02cb6d6f3f5cb071395572aa0b4
SHA1: 6e247911839419f46f1a3a56f76a819305738fdd
VT: 1/61 - Kaspersky: Trojan.Java.Agent.sb
Compiled: March 17 2026 at 17:12:14
SHA256: bd3997c44f1820eccc6574ee003bf5319b6a27d28e782937271c6ae190af024d
File: Merluis-Setup-2.0.0.exe - NSIS installer
MD5: 6cda615633eadf8cb0529efc6c722973
SHA1: 5574dee4b8874c2175c852c1dbfec272db48778e
VT: 0/58 - BYOR technique bundles Java JRE 1.8.0_101
SHA256: 6f6ee4710884d7b9a6fe498ffe66d0833ccdaddc2a99dff529a42fce2ed32d50
File: Merluis.exe - Electron launcher/wrapper
MD5: 39055af3485c58631341edae17938ad2
SHA1: a39d652c686c6a0ba4b27533676c5ae68ed19e8a
VT: 1/69 - SecureAge: Malicious
Victim forensic investigation via javap static analysis
and jdb live debugger in REMnux VM.
Law enforcement notified:
FBI IC3: fad477e92b9f4692b96be4eac6236d20
CISA: CCASE0175447