MalwareTipsTools

File scan report

Scan another file

Verdict Malicious

Analyzed , 2 days ago

Is RelayGram.zip safe? No, we rate this exact file malicious.

Twenty-two of the 68 antivirus engines that checked it flag this password-protected archive, with Kaspersky and Trend Micro naming the Cridex worm and Malwarebytes calling it spyware.

Strong evidence · Two or more major antivirus engines agree.

Don't open or extract this archive

Delete the archive without extracting it. If it was already opened on a machine, run a full scan with your security software kept enabled and change passwords for the accounts used on that device, particularly messaging and banking accounts.

What to do now3 steps

This ZIP archive is harmful. Don't open or extract it, and delete it.

If you haven't opened or extracted it

  1. Don't open or extract this archive. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash.

If you already opened or extracted it

  1. If you already extracted it, delete the extracted files too and run a full antivirus scan.

  2. If a page it opened asked for a password or card details and you entered them, change that password and call your bank.

If you opened or installed it

Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Share this file report

RelayGram.zip: Malicious — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Antivirus results

22 of 68 flagged

  • Flagged 22
  • No detection 46
  • No result 7
FileRelayGram.zip29.2 MBSHA-256 799c9a5e17e6…6c62c0
  • Code signing Not applicable
  • Test run Completed
  • First seen 1mo ago
When we scanned it, 1 source had submitted it to VirusTotal.

Chapter 02

Why we think so

6 points against it and 3 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

The archive was flagged by 22 of the 68 antivirus engines that checked it, five of them high-reputation, and Kaspersky and Trend Micro both name the Cridex family while Malwarebytes labels it a stealer. The sandbox unpacked a Windows executable from it using the common "infected" password, a habit that keeps the inner payload away from filters and static scanners. Automated execution did not visibly detonate, but that is common for stealers that stall under inspection.

Full reasoning

The detection spread is broad and independent: 14 distinct engine families flagged the archive, and the high-reputation detections are not a single shared engine. Kaspersky and Trend Micro both name Cridex, while Sophos, Trellix and the BitDefender-derived cluster call it a generic trojan and Malwarebytes labels it spyware, which points to a credential-stealing worm rather than a mislabelled installer. Prevalence is low (one submitting source, first seen on Oct 1, 2026) and no reference database lists the hash, so the public record adds nothing either way. The sandbox summary is the only contrary note: the combined sandbox verdict was clean, no injected processes and no outbound traffic, but the archive only unpacked its executable with the standard password, so the inner payload was never meaningfully exercised. With that many corroborating high-reputation detections and a named family, the archive warrants deletion rather than trust.

Detailed assessment

What We Detected

This is a ZIP archive holding a Windows executable. 22 of the 68 antivirus engines that checked it flagged it, including five high-reputation engines counted as independent votes after collapsing vendors that license the same scan engine. Kaspersky reports Worm.Win32.Cridex and Trend Micro reports Worm.Win64.Cridex, both naming the Cridex family; Malwarebytes labels the archive as spyware/stealer, and K7 antivirus and Rising add worm-oriented labels. Others, including Sophos, Trellix and the BitDefender-linked cluster, fall back to generic trojan names.

Threat Behavior

The archive is password protected with the widely used "infected" convention, and the analysis environment needed that password to unpack an executable with the same name as the archive into a temporary folder. That packaging is not itself malicious, but it is a standard way to stop mail gateways and static scanners from inspecting the payload inside. Two sandbox runs finished with a clean overall result and recorded no outbound connections, no injected processes and no persistence changes; the only defensive mapping noted is a defence-tampering label without the corresponding artefact, so it is not treated as observed behaviour. The file also carries analysis tags for debugger-environment detection and long sleeps, which are typical of malware that waits when it suspects it is being watched, which would explain the quiet run.

What To Do Now

Treat this archive as unsafe and delete it without extracting it. If it was opened, run a full scan with your security software, keep that protection enabled, and change passwords for any accounts the machine uses, especially messaging and banking accounts, since Cridex-lineage code is built to harvest credentials. Do not redistribute the file to others for testing outside a proper analysis environment.

Where this verdict could be wrong4 caveats
  • The combined sandbox result was clean and no hostile network traffic was recorded, so the payload did not visibly detonate during automated execution.
  • Several major engines, including ESET-NOD32, Avira, Avast, AVG, DrWeb and F-Secure, returned no detection at all.
  • No reference database lists this hash and only one source has submitted it, so the public record is thin for a file this widely flagged.
  • The archive was only statically opened, not fully exercised, so a payload that stays dormant when it detects an analysis environment would look quiet.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points in its favour
  • Two sandbox runs completed with a clean overall result and no injected processes or outbound connections were recorded
  • No malicious dropped file was identified among the extracted items
  • No reference database in our checks lists this hash, so nothing points to a known campaign using these exact bytes
Points against
  • 22 of the 68 antivirus engines that checked it flag the archive, including five high-reputation engines
  • Kaspersky and Trend Micro both name Cridex, a credential-stealing worm family
  • Malwarebytes labels the contents as spyware/stealer, matching credential theft rather than nuisance software
  • The archive is password protected and only reveals its Windows executable after the common "infected" password is supplied, which defeats mail filters and static inspection
  • Analysis tags note debugger-environment detection and long sleeps, behaviour typical of code that avoids running under inspection
  • The file is rare, submitted by one source, and has no known software history behind it

6 sources checked · 5 complete · 1 not needed or not applicable. See every source

Chapter 03

What it did in our test

It ran in 2 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete
  • 2isolated sandbox runs
  • 3sandbox rule tags
  • 2spawned processes
  • 0network contacts
  • 5filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

  • Moderate concern: Checked whether it was running on a test computer.

  • Note: Read basic details of the test computer, such as its Windows version.

Sandbox labels we could not confirm (common in safe files too)

  • Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Threat context

How password stealers work

A password stealer runs quietly in the background and copies your private data, such as saved passwords, browser cookies, autofill details and crypto wallets, then sends it to criminals. You usually won't notice anything.

Bottom line:Stolen logins are used to break into your accounts or sold in bulk, so change passwords from another device.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

  1. Input file

    The submitted object

    1
    1. Evidence 1 of 5: FileSeen in the test run

      RelayGram.zip

      799c9a5e17e62fa235f29bd9981107b75b557074719f976444e9bfd2ea6c62c0

      Uploaded file

  2. Processes

    What ran

    2
    1. Evidence 2 of 5: ProcessSeen in the test run

      unarchiver.exe

      C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\RelayGram.zip"

      Test run
    2. Evidence 3 of 5: ProcessSeen in the test run

      7za.exe

      C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\0chvgky2.slf" "C:\Users\user\Desktop\RelayGram.zip"

      Test run
    3. +1 more recorded observation

  3. Files

    Created or changed

    2
    1. Evidence 4 of 5: Written fileSeen in the test run

      0chvgky2.slf

      C:\Users\user\AppData\Local\Temp\0chvgky2.slf

      Test run
    2. Evidence 5 of 5: Written fileSeen in the test run

      RelayGram.exe

      C:\Users\user\AppData\Local\Temp\0chvgky2.slf\RelayGram.exe

      Test run
    3. +1 more recorded observation

5 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was detonated in 2 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

1
  • VT: CLEANclean

Techniques observed in the sandbox

3

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

  • T1082· System recon
  • T1497· Sandbox evasion
  • T1562.001· Disables security

Observed activity

Processes started
2

Programs the file ran, with their command lines.

  • unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\RelayGram.zip"
  • 7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\0chvgky2.slf" "C:\Users\user\Desktop\RelayGram.zip"
Files
5

Files the file created, changed or deleted.

  • WrittenC:\Users\user\AppData\Local\Temp\0chvgky2.slf
  • WrittenC:\Users\user\AppData\Local\Temp\0chvgky2.slf\RelayGram.exe
  • WrittenC:\Users\user\AppData\Local\Temp\unarchiver.log
  • Written\Device\ConDrv\\Connect
  • Writtenstdout
Sandbox background — not the file
1

The analysis machine's own processes and connections, recorded in every run.

  • VM processconhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Dropped payload

Files this sample writes at runtime

This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.

2 not checked
  • a00e13602b27e2cec71a…078f3fNot checked
    no saved verdict
  • 2a185c0f2f13f732443e…b10f8dNot checked
    no saved verdict

Chapter 04

Technical details

22 of the 68 antivirus engines that checked it flag it.

Sources checked

Every check behind this verdict

6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 75 enginesCompleteRisk signal: 22 of 68 engines flagged it · 7 gave no result Details for antivirus engines
Sandbox runVirusTotal sandboxes · CAPE Sandbox, ZenboxComplete2 runs: 1 clean, 1 without a verdict Details for sandbox run
Contacted hostsMalwareTips URL scannerNot neededThe sandbox recorded no contacted hosts to checkNo date recorded
Signature rulesYARAify community rules + MalwareTips rulesCompleteNo rule matched
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match

Engines that flagged it 22

  • BitDefender (major engine)QD:Trojan.GenericKDQ.20E2BC90D5
  • Emsisoft (major engine)QD:Trojan.GenericKDQ.20E2BC90D5 (B)
  • GData (major engine)QD:Trojan.GenericKDQ.20E2BC90D5
  • Kaspersky (major engine)Worm.Win32.Cridex.akfh
  • Sophos (major engine)Mal/Generic-S
  • TrellixENS (major engine)Artemis!EB0C4411F401
  • TrendMicro (major engine)Worm.Win64.CRIDEX.TL0101FB26ZW
  • TrendMicro-HouseCall (major engine)Worm.Win64.CRIDEX.TL0101FB26ZW
14 more in the full engine list

File fingerprint

Last analyzed
Nov 8, 2026, 5:26 PM UTC
SHA-256
799c9a5e17e62fa235f29bd9981107b75b557074719f976444e9bfd2ea6c62c0
SHA-1
e3cc73944562d5e5e1860f4075d555da7372a5da
MD5
6dbbcc5f8dfb7bb359761bf21d8bc902

About this file

RelayGram.zip is a ZIP file of 29.2 MB.

Type and size
ZIP · 29.2 MB
Signer
Not applicable
First seen
Oct 1, 2026On VirusTotal.
Submitted by
1 sourceRarely seen: few people have submitted this exact file.

First scanned

Antivirus consensus

22 of 68 engines flagged this file

22 malicious0 suspicious46 not flagged7 no result

7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

The 22 detections come from 14 independent scan engines: several vendors license the same engine, so their results are one vote.

  • Tier-118 engines
    5flagged
    8 vendors sharing 5 engines
  • Tier-237 engines
    7flagged
    11 vendors sharing 7 engines
  • Low-trust13 engines
    3flagged
View all 75 engine results
  • ALYacMalicious: QD:Trojan.GenericKDQ.20E2BC90D5
  • ArcabitMalicious: QD:Trojan.GenericQ.20E2BC90D5
  • BitDefenderMalicious: QD:Trojan.GenericKDQ.20E2BC90D5
  • BkavMalicious: W32.Malware.542CFB1D
  • CTXMalicious: zip.trojan.generickdq
  • DeepInstinctMalicious: MALICIOUS
  • EmsisoftMalicious: QD:Trojan.GenericKDQ.20E2BC90D5 (B)
  • GDataMalicious: QD:Trojan.GenericKDQ.20E2BC90D5
  • GoogleMalicious: Detected
  • K7AntiVirusMalicious: EmailWorm ( 006e155a1 )
  • K7GWMalicious: EmailWorm ( 006e155a1 )
  • KasperskyMalicious: Worm.Win32.Cridex.akfh
  • MalwarebytesMalicious: Spyware.Stealer
  • MaxSecureMalicious: Trojan.Malware.690617844.susgen
  • MicroWorld-eScanMalicious: QD:Trojan.GenericKDQ.20E2BC90D5
  • RisingMalicious: Worm.Cridex!8.BB3 (CLOUD)
  • SophosMalicious: Mal/Generic-S
  • TrellixENSMalicious: Artemis!EB0C4411F401
  • TrendMicroMalicious: Worm.Win64.CRIDEX.TL0101FB26ZW
  • TrendMicro-HouseCallMalicious: Worm.Win64.CRIDEX.TL0101FB26ZW
  • VaristMalicious: W64/ABTrojan.RXVM-0330
  • VIPREMalicious: QD:Trojan.GenericKDQ.20E2BC90D5
  • AcronisClean
  • AhnLab-V3Clean
  • AlibabaClean
  • alibabacloudClean
  • Antiy-AVLClean
  • APEXNo result
  • AvastClean
  • Avast-MobileClean
  • AVGClean
  • AviraClean
  • BitDefenderFalxNo result
  • CAT-QuickHealClean
  • ClamAVClean
  • CMCClean
  • CrowdStrikeClean
  • CylanceNo result
  • CynetClean
  • DrWebClean
  • ElasticClean
  • ESET-NOD32Clean
  • F-SecureClean
  • FortinetClean
  • GridinsoftClean
  • huorongClean
  • IkarusClean
  • JiangminClean
  • KingsoftClean
  • LionicClean
  • McAfeeDClean
  • MicrosoftClean
  • NANO-AntivirusClean
  • PaloaltoNo result
  • PandaClean
  • SangforClean
  • SentinelOneClean
  • SkyhighClean
  • SUPERAntiSpywareClean
  • SymantecClean
  • SymantecMobileInsightNo result
  • TACHYONClean
  • tehtrisNo result
  • TencentClean
  • TrapmineNo result
  • TrustlookClean
  • VBA32Clean
  • VirITClean
  • ViRobotClean
  • WebrootClean
  • XcitiumClean
  • YandexClean
  • ZillyaClean
  • ZoneAlarmClean
  • ZonerClean
Prevalence

How widely this file has been seen

Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.

Rare & old
Unique uploaders
1
Very few people have ever uploaded this — rare.
Total submissions
1
Includes repeat uploads by the same source.
First seen
1mo ago
Oct 1, 2026
Prevalence quadrant
Rare · New
Needs evidence-led scrutiny
Common · New
Just-released software
here
Rare · Old
Niche or internal tooling
Common · Old
Often established software

Chapter 05

Questions & answers

Short answers to the 8 questions people ask most about this file.

Is RelayGram.zip malware?
Yes. This copy of RelayGram.zip (SHA-256 799c9a5e…62c0) is malicious. Other files with the same name can be different, so check the hash. Don't open or extract it. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash. 22 of the 68 antivirus engines that checked it flag it, some as Cridex. Antivirus engines classify it as a password stealer, built to copy saved passwords, cookies and crypto wallets. If you've already opened or extracted it, see the steps below.
What is RelayGram.zip?
RelayGram.zip is a ZIP archive, about 29.2 MB. VirusTotal first saw it on Oct 1, 2026.
How many antivirus engines detected RelayGram.zip?
22 of the 68 antivirus engines that checked it flag RelayGram.zip, including Kaspersky and Bitdefender. We weigh which engines flagged it and what else the scan found, not just the count. The rating comes from all the evidence together, not from this count alone.
I already downloaded and opened or extracted RelayGram.zip — what should I do?
1) Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash. 2) Run a full scan with your antivirus. 3) If it asked you to enable editing or macros, or a page it opened asked for a password or card details, change that password from another device and call your bank if you paid.
How do I remove RelayGram.zip?
Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash. If you ran anything that was inside it, run a full scan with your antivirus.
What kind of malware is RelayGram.zip?
Antivirus engines classify RelayGram.zip as a password stealer, built to copy saved passwords, cookies and crypto wallets. Engines attribute it to the Cridex family.
What is the SHA-256 hash of RelayGram.zip?
The SHA-256 fingerprint of RelayGram.zip is 799c9a5e17e62fa235f29bd9981107b75b557074719f976444e9bfd2ea6c62c0, and its MD5 is 6dbbcc5f8dfb7bb359761bf21d8bc902. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
How up to date is this analysis of RelayGram.zip?
This report reflects the scan on Nov 8, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Recent reports on other files with the same rating.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.