MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e5dbe753b1b2d61c831e37a6805e93cb568125fd0874203e9d424c5b2a430ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1e5dbe753b1b2d61c831e37a6805e93cb568125fd0874203e9d424c5b2a430ee
SHA3-384 hash:	678479768b7553d1d040a25c34f67caf053e6b944bc3066e75d15e88564af5d3374a4f5b1dd46adbadeb1beaa51112b4
SHA1 hash:	a36e59d5ca968a46ff51f2fb975f50fce2155d3d
MD5 hash:	9fff92c7f7822f32b3efbad9b4799793
humanhash:	two-table-massachusetts-berlin
File name:	sombr.hta
Download:	download sample
Signature	EternalRocks Alert Create hunting rule
File size:	59'297 bytes
First seen:	2026-03-01 11:57:45 UTC
Last seen:	2026-03-02 07:32:36 UTC
File type:	hta
MIME type:	text/html
ssdeep	1536:+++Uv++jxyncGg856bVA7Z+JYVB5Q4YeCT+VLifnl+RO5w/ww15Y1+Wxf:n
TLSH	T1F0433CB171B499F11152EB7AC0B24F48DF25314A5D767CE2B6E802064CF9E233DDA9B2
TrID	66.6% (.HTML) HyperText Markup Language (UTF-8) (6000/1/1) 33.3% (.TXT) Text - UTF-8 encoded (3000/1)
Magika	html
Reporter	aachum
Tags:	77-238-228-60 ACRStealer ClickFix FakeCaptcha hta

iamaachum

https://refviewpage.t3.storage.dev/index.html => http://185.193.89.158/sombr.aif

ACRStealer C2: 77.238.228.60

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

59

Origin country :

ES

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a426848fffa866e3b3b414

Tags:

infosteal rapid

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/1e5dbe753b1b2d61c831e37a6805e93cb568125fd0874203e9d424c5b2a430ee/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/69a429d8cd25bfe1dfdd38aa/reports/970bdb6b-664b-495c-be95-193012de24c9/overview

Hybrid Analysis GT:VB.Corona.4

Verdict:

Malicious

Labled as:

GT:VB.Corona.4

Link:

https://www.hybrid-analysis.com/sample/1e5dbe753b1b2d61c831e37a6805e93cb568125fd0874203e9d424c5b2a430ee

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic Trojan-Downloader.Win32.PsDownload.sb Trojan.Win32.PowerShell.d PDM:Trojan.Win32.Generic PDM:Exploit.Win32.Generic Trojan-Downloader.JS.SLoad.sb

Link:

https://opentip.kaspersky.com/1e5dbe753b1b2d61c831e37a6805e93cb568125fd0874203e9d424c5b2a430ee/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1876465

Signature

Antivirus detection for URL or domain

Contains functionality to hide a thread from the debugger

Encrypted powershell cmdline option found

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Multi AV Scanner detection for submitted file

Powershell drops PE file

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Unusual module load detection (module proxying)

Behaviour

Behavior Graph:

Download SVG

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1e5dbe753b1b2d61c831e37a6805e93cb568125fd0874203e9d424c5b2a430ee/

Neiki Trojan-Downloader.Win32.PowerShell

Verdict:

Malicious

Threat:

Trojan-Downloader.Win32.PowerShell

Link:

https://tip.neiki.dev/file/1e5dbe753b1b2d61c831e37a6805e93cb568125fd0874203e9d424c5b2a430ee

ReversingLabs TitaniumCloud Win32.Trojan.Corona

Threat name:

Win32.Trojan.Corona

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-01 11:44:11 UTC

File Type:

Text (HTML)

Extracted files:

2

AV detection:

6 of 36 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dzo345j3dmwwdsbr4n5gqbpjhs2wqes72cduea7j2qsmlmvegdxa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution spyware stealer

Link:

https://tria.ge/reports/260301-n49twsfw3f/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1e5dbe753b1b2d61c831e37a6805e93cb568125fd0874203e9d424c5b2a430ee