MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1
SHA3-384 hash:	a4544482293598f12f584914632fad8a6183f56ba34fb719d848170dac56fb2d52757cb2ecf62897815ade26e7a7209e
SHA1 hash:	0e6dadeb64dfd43d8cc8fbd786f753f92bf523a1
MD5 hash:	c886d3941210d0a7ce625e4d7be89c1a
humanhash:	beer-timing-sixteen-harry
File name:	dtxa.hta
Download:	download sample
File size:	17'309 bytes
First seen:	2025-12-02 21:13:33 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	384:VOLgInpEb3egcNMziLVT5emZpT72qfKsXdo3/NFoZUsQI:g1pEb3NYLVtfJN
TLSH	T113724F353D9AB404967EE51AE22FA316FC69344BEC109C8335D339972A033D569C35BE
Magika	html
Reporter	Anonymous
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

38

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=692f56a816e6db515e460d93

Tags:

obfuscated vmdetect virus overt

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.io

Gathering data

Hybrid Analysis GT:VB.ObfDldr.31

Verdict:

Malicious

Labled as:

GT:VB.ObfDldr.31

Link:

https://www.hybrid-analysis.com/sample/0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1

InQuest

Result

Gathering data

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

html

Link:

https://opentip.kaspersky.com/0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1/results?tab=lookup

Nucleon Malprob Susipicious

Score:

69%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/c886d3941210d0a7ce625e4d7be89c1a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1

ReversingLabs TitaniumCloud Win32.Trojan.Etset

Threat name:

Win32.Trojan.Etset

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-29 20:10:58 UTC

File Type:

Text (VBS)

AV detection:

11 of 36 (30.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ajiaddvmygybhynuezaxksi56nen2c235r5bvahqkvnffuv6hkqq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/251202-z3eg5sbm2t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1