MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69b4b984cfbe5bdfae6a4c40f3b9d890619661cb61c9f7b90850335c2d4d4eed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 6 File information Comments

SHA256 hash:	69b4b984cfbe5bdfae6a4c40f3b9d890619661cb61c9f7b90850335c2d4d4eed
SHA3-384 hash:	22a77df849da48027e341752afed699346379560ceec3bcd1ccf4b46fd4affcbe4cef8d5a7efed161769c3bbf903afbe
SHA1 hash:	f6c9175e484657c44038a404709e3867af0d8a73
MD5 hash:	b9ec480432d5f25b8ee94f791e140a95
humanhash:	beryllium-skylark-robin-white
File name:	zip.zip
Download:	download sample
File size:	71'524 bytes
First seen:	2026-09-05 16:14:06 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1536:VNnSAPg8DdHXdnSYVh2lY1OZxMGyWYVpM1rmK90ep6kDhkd:GAY8D1tn72BrMDY1rr0eQ0kd
TLSH	T1516302859E56A512E74C3CAECFE7E301F6159A30DBC20699A972F74C45EE09D343728C
Magika	zip
Reporter	skocherhan
Tags:	qdzip-1476850762-cos-ap-singapore-myqcloud-com zip

skocherhan

https://qdzip-1476850762.cos.ap-singapore.myqcloud.com/zip.zip

Intelligence

File Origin

# of uploads :

# of downloads :

107

Origin country :

File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:	1.bat
File size:	201 bytes
SHA256 hash:	d0a60cb408e0b96d042527c03654b77bfab2a683de410e94550e8d8cef1c80c0
MD5 hash:	7c8da380c3f81fd2d567ca03daedcd9c
MIME type:	text/x-msdos-batch

File name:	1.dll
File size:	35'328 bytes
SHA256 hash:	4a61bc2c85c1837b3ed7218379d038ccfc6fe3e1052118fcefb8a8efd8d9df09
MD5 hash:	604ef9859483a63a25b8bf3763d4a925
MIME type:	application/x-dosexec

File name:	WmirvSE.exe
File size:	79'344 bytes
SHA256 hash:	273cc0262464bed59dccdc9f9a4ec1e73ec89a3db6b70f8c72036df92f6c3e76
MD5 hash:	9da8611c516e771c101f06ac53368b01
MIME type:	application/x-dosexec

File name:	2.dll
File size:	35'328 bytes
SHA256 hash:	24f9147854220aaa75b8f9a7ad0951ef5404e33e8750ff5e7cfbe8abeba10708
MD5 hash:	7527abff618b1bd456764a3d3814b0b4
MIME type:	application/octet-stream

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ad4a41c2-1cc8-4508-890f-ef23a3d20345/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac8dde32465289d815dea2d

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

microsoft_visual_cc overlay packed

Link:

https://www.filescan.io/uploads/6a9c3fd3cc603a23de556a62/reports/657566a0-1812-4a82-b538-1988614d8332/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/69b4b984cfbe5bdfae6a4c40f3b9d890619661cb61c9f7b90850335c2d4d4eed

Verdict:

Unknown

File Type:

zip

First seen:

2026-09-03T06:31:00Z UTC

Last seen:

2026-09-06T04:06:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/69b4b984cfbe5bdfae6a4c40f3b9d890619661cb61c9f7b90850335c2d4d4eed/results?tab=lookup

Score:

12%

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

edb39ff9d3b9dcf25e865c8a212454b08ef1b78e64f33967fa6072269e6ee883

zip 69b4b984cfbe5bdfae6a4c40f3b9d890619661cb61c9f7b90850335c2d4d4eed

(this sample)

4a61bc2c85c1837b3ed7218379d038ccfc6fe3e1052118fcefb8a8efd8d9df09

https://x.com/skocherhan/status/2096268411646963922

Dropped by

MD5 c1915077f15975c73341f7411c701c9d

Dropped by

MD5 79515c103af71720f212bc2ec6495845

Dropped by

MD5 01be589e3b5b318c57883aa49d04a0b1

Dropped by

MD5 64650b6da684d12ad55bdae6dbe026c7

Dropped by

MD5 96d67813d9abe3b4c81545145674656e

Dropped by

MD5 f4bbf6a42963e37baa96c3fbb707a049

Dropped by

SHA256 edb39ff9d3b9dcf25e865c8a212454b08ef1b78e64f33967fa6072269e6ee883

Dropping

SHA256 4a61bc2c85c1837b3ed7218379d038ccfc6fe3e1052118fcefb8a8efd8d9df09

Dropping

SHA256 d0a60cb408e0b96d042527c03654b77bfab2a683de410e94550e8d8cef1c80c0

Dropping

SHA256 24f9147854220aaa75b8f9a7ad0951ef5404e33e8750ff5e7cfbe8abeba10708

Dropping

SHA256 273cc0262464bed59dccdc9f9a4ec1e73ec89a3db6b70f8c72036df92f6c3e76

URLhaus

https://urlhaus.abuse.ch/url/3912778/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample