ArchiveGenocide - fake "verify you are human" malware campaign
Version 1.2, 23 October 2026. Full write-up: https://archivegenocide.com/malware-report/
Everything is defanged (hxxps, [.]). Refang it before putting it into a tool. Do not visit these.

NETWORK
archievegenocide[.]com                   lookalike of our name; content varies by visitor (see section 7)
cloubflare[.]top                         delivery, imitates Cloudflare
hxxps://cloubflare[.]top/4               serves the .msi
hxxps://cloubflare[.]top/5               listed by URLhaus as a malware URL
hxxps://cloubflare[.]top/login           seen in public scans; purpose unknown
minnarasanen[.]com                       control server, 109.238.86.137, AS201738
hxxps://minnarasanen[.]com/nfront.php    check-in and tasking
hxxps://minnarasanen[.]com/nback.php     results
hxxps://ipinfo[.]io/what-is-my-ip        normal service, used for the sandbox check

Not listed on purpose: the server addresses of archievegenocide[.]com (they may be shared with
unrelated sites) and walinternet[.]com (seen on the control server's address, connection unknown).

SHA-256, THE FIVE STAGES
c0e53cb9de9f4be3e13d7fcb4bd91423df00909b9f8a148c665185accf24f3b6   stage 1, the .msi (S791.msi)
8cde125070853afe74fae47de1b0b998cdc7c74aceda819ed715aadde9216dda   stage 2, PowerShell script
8e76a43bf8c239620dc8cf00857e0292525dd6d28cabbf0a8a82cc0e9aacf01b   stage 2, encoded program
3a5fbb34e9d361e8b4887943ba9b7543dce23c7e7fa27412c5aeb988a7733ffa   stage 3, crypter
2c33be41a7bf087a29fa8b8367aa8e64802a50a825c0180ed5401c542628b39e   stage 4, shellcode (after byte reversal)
9003c9e30f7ab84d7ac99c83961b236bb5da1adf9211af7b38ddaae27922d6d1   stage 5, final payload

MD5 AND IMPORT HASHES
65f26b1294a0b1bad9460b4566b300d6   stage 1, MD5
089d9c0f59ae90fd14903e3128572f25   stage 3, MD5
5fcab591f2bb814f021784af7fbe4a63   stage 5, MD5
241b6302ab625ed2e79213b6b4dfdeb2   stage 3, import hash
a3beeb86b2d4a4a9c89d5ff3fe8bc4e0   stage 5, import hash

STAGE 3 VERSION INFO (as shown by VirusTotal)
InternalName      sheet_invoice_nutrition
OriginalFilename  sheet_invoice_nutrition
ProductName       Sheet Invoice Nutrition Viewer
FileDescription   Invoice Publish and Analyze Viewer
FileVersion       6.36.49.867
LegalCopyright    Copyright (c) 2022 by The Sheet Forge

RELATED SAMPLES FLAGGED BY 15+ ENGINES (all 36 are in related_samples_2026-10-23.csv)
612d671624b4f0f88c91960756b08692cc5fa9211f86d993ecd576ce112097bd   46/71  EXE        16 Oct  261016-y2hbzazxh1_sample.bin, skill_lesson_generator
68ae9b66f9166047b34b4ec3a35383e485c68702d48bc5ef7ce2492e4e28048f   24/68  EXE        22 Oct  R92e2i2kC_decoded.bin, ypvs3fze.exe
624ef5daed1bf4a20c25bf0ee5c1a78076a8977c932dc6ae2a55a483707c0115   19/54  PowerShell 17 Oct  P600.ps1
8db39bf900bb14691992a1ad2d118cfc54435b20f35d3dc64f988bf6eee7226f   19/55  EXE        20 Oct  triggerdesigner, payload.bin
f5f2d1f10a88e782ffbbdf3c0698aaa1fc72fa19ba7ca6121fe9a7d4f9f65d5e   17/66  EXE        23 Oct  trigger_workflow_builder, ToyURn748_decoded.exe

Installer metadata, GUIDs, stream names and registry names change with every build. Don't rely on them.