{"id":10429,"date":"2026-10-24T21:04:28","date_gmt":"2026-10-24T21:04:28","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=10429"},"modified":"2026-10-24T21:04:28","modified_gmt":"2026-10-24T21:04:28","slug":"solving-practical-problems-with-ai-part-2-the-most-popular-and-most-commonly-used-passwords-for-malicious-archives","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2026\/10\/24\/solving-practical-problems-with-ai-part-2-the-most-popular-and-most-commonly-used-passwords-for-malicious-archives\/","title":{"rendered":"Solving practical problems with AI \u2013 Part 2 \u2013 the most popular, and most commonly used passwords for malicious archives&#8230;"},"content":{"rendered":"\n<p>I remember that a few years ago, when I still used Twitter, I asked an open-ended question there: what are the most common passwords used for malware archives? <\/p>\n\n\n\n<p>This may sound silly, but there are a looooooot of the &#8216;default&#8217; ones out there. And while at that time I got a few good answers, most of them circulated around the usual suspects:<\/p>\n\n\n\n<ul>\n<li>malware<\/li>\n\n\n\n<li>virus<\/li>\n\n\n\n<li>infected<\/li>\n\n\n\n<li>inf3cted<\/li>\n\n\n\n<li>etc.<\/li>\n<\/ul>\n\n\n\n<p>and their variants.<\/p>\n\n\n\n<p>Today, using AI, we can dig deeper.<\/p>\n\n\n\n<p>Googling:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">default malware sample passwords including infected virus malware \"inf3cted\"<\/pre>\n\n\n\n<p>adds a few possible candidates, but then we start asking more questions and we end up adding the following entries:<\/p>\n\n\n\n<ul>\n<li><a href=\"https:\/\/github.com\/LJ9859\/Malware-Database\">1337<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/dl.malwarewatch.org\/\">mysubsarethebest<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/snorrefagerland.github.io\/virushistory\/\">history<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/support.kaspersky.com\/krs\/3.0\/DefaultArchivePasswords\">pass<\/a><\/li>\n\n\n\n<li>god<\/li>\n\n\n\n<li><a href=\"https:\/\/bazaar.abuse.ch\/sample\/805963dc775b0107e60e83570e05ca7ef4f1c47b5537f850bd65819ff0d75667\">123<\/a><\/li>\n\n\n\n<li>1234<\/li>\n\n\n\n<li>123456<\/li>\n\n\n\n<li>12345678<\/li>\n\n\n\n<li>123456789<\/li>\n\n\n\n<li>111111<\/li>\n\n\n\n<li>qwerty<\/li>\n\n\n\n<li><a href=\"http:\/\/freelist.virussign.com\/freelist\/\">virussign<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/bazaar.abuse.ch\/sample\/a938f6ae441a83c2bd48e32d0dadefb40bb791a1d5abe4428f8b9126bc17a3a0\/\">8466<\/a><\/li>\n\n\n\n<li>infected_pcap<\/li>\n\n\n\n<li>infected666 + the last character before the zip extension<\/li>\n\n\n\n<li>clean (this is for clean samples)<\/li>\n\n\n\n<li>velvet<\/li>\n\n\n\n<li>VelvetSweatshop (old, default password for Excel)<\/li>\n\n\n\n<li><a href=\"https:\/\/www.reddit.com\/r\/SentinelOneXDR\/comments\/1mh27yc\/downloading_a_threat_file\/\">S1BinaryVault<\/a><\/li>\n\n\n\n<li>p@ssword<\/li>\n\n\n\n<li>shipped<\/li>\n\n\n\n<li>invoice<\/li>\n\n\n\n<li>doc<\/li>\n<\/ul>\n\n\n\n<p>The most powerful bit here is not the list of all the possible passwords we can generate, but the list of prompts that got us here. I don&#8217;t include them in this post, because I want to emphasize that it was not really AI that did all the work, but&#8230; me. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>I remember that a few years ago, when I still used Twitter, I asked an open-ended question there: what are the most common passwords used for malware archives? This may sound silly, but there are a looooooot of the &#8216;default&#8217; &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2026\/10\/24\/solving-practical-problems-with-ai-part-2-the-most-popular-and-most-commonly-used-passwords-for-malicious-archives\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[68,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10429"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=10429"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10429\/revisions"}],"predecessor-version":[{"id":10432,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10429\/revisions\/10432"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=10429"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=10429"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=10429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}