🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e2612d964aaf92e7b57bccab58349518bcdfd3a3f07e1c70a71f4f6f6fef16c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e2612d964aaf92e7b57bccab58349518bcdfd3a3f07e1c70a71f4f6f6fef16c
SHA3-384 hash: 4f91e7270d206456f503bfdb064827c030fb1216e02aa4b459bf17e571055d5b25ef96e815d89fa3589b509f2e29fe81
SHA1 hash: eb778efaa71bdc1ed56a11550122f81cdfa32e93
MD5 hash: 9b12193eafd58af055f425227fa1977d
humanhash: ten-lactose-november-vermont
File name:AS-2026-1048.zip
Download: download sample
File size:453'070 bytes
First seen:2026-10-24 19:17:33 UTC
Last seen:2026-10-24 19:20:02 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:RsMqHLqc9WtzeoZKNBDS5yHZI9aw828Ik:RsVHOcEtz5gNBDOy53w8Qk
TLSH T105A4231C47EC90AE3E1EF8F07BE8C550E4DB5A1563D142A06401A79EBBDF6A25BDC324
Magika zip
Reporter skocherhan
Tags:share-adminsimple-s3-eu-west-2-amazonaws-com zip


Avatar
skocherhan
https://share-adminsimple.s3.eu-west-2.amazonaws.com/October2026/AS-2026-1048.zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
179
Origin country :
GB GB
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:assets.dll
File size:698'880 bytes
SHA256 hash: 136f43e74a23ebcff091527c02ddd9367f2554acab26a862258163840dbc85c0
MD5 hash: e80ff095b8cc68cbd0d40cc57c4d1124
MIME type:application/x-dosexec
File name:101
File size:118 bytes
SHA256 hash: 4bcf4a8c1ff8a4cbbe96b0449df94274150823f5dfcc35dce50e51c952cce4cb
MD5 hash: 6ac8f9ee90e2780aa7fe588d466d9c4e
MIME type:application/octet-stream
File name:Administrative Review - October 2026.lnk
File size:1'732 bytes
SHA256 hash: f69d9828d45c98dd818d17585d303d0c2c173fc97716d3cabd4336ac7a31aff3
MD5 hash: 60db5de3d94dfa1cf29d566057c8e9c0
MIME type:application/octet-stream
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/802e4bb4-9886-42a5-9448-ead3a2bbb3b6/
Detection(s):
Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADaymsiexec.20231121.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLook.20220622.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6add047c5a22ac805bd9fa11
Tags:
malware
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/2e2612d964aaf92e7b57bccab58349518bcdfd3a3f07e1c70a71f4f6f6fef16c/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug microsoft_visual_cc
Link:
https://www.filescan.io/uploads/6add0478edec72700a809ea1/reports/fb808c23-678a-4e88-be9a-c04f04042e48/overview
Verdict:
Suspicious
Labled as:
Troj/DownLnk
Link:
https://www.hybrid-analysis.com/sample/2e2612d964aaf92e7b57bccab58349518bcdfd3a3f07e1c70a71f4f6f6fef16c
Verdict:
Malicious
File Type:
zip
First seen:
2026-10-20T09:25:00Z UTC
Last seen:
2026-10-25T20:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2e2612d964aaf92e7b57bccab58349518bcdfd3a3f07e1c70a71f4f6f6fef16c/results?tab=lookup
Score:
88%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/2e2612d964aaf92e7b57bccab58349518bcdfd3a3f07e1c70a71f4f6f6fef16c
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable LNK PDB Path PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/9b12193eafd58af055f425227fa1977d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e2612d964aaf92e7b57bccab58349518bcdfd3a3f07e1c70a71f4f6f6fef16c/
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-10-20 22:20:09 UTC
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fytbfwlevl4s462xxtflla2jkgf437j2h4d6drykoh2pn5x66fwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e2612d964aaf92e7b57bccab58349518bcdfd3a3f07e1c70a71f4f6f6fef16c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:TigerRAT_pe_yaraify
Create hunting rule
Author:hunts-yara-code
Description:YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://x.com/malwrhunterteam/status/2114073233796337896

Comments