MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a1362fa7088d9eb063f1abb03bc04cd15ea2a2c8f5e64859a9d1bb3acc6275b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6a1362fa7088d9eb063f1abb03bc04cd15ea2a2c8f5e64859a9d1bb3acc6275b
SHA3-384 hash:	088f3181b8212aba1ec4bd1e9eb40a59d3583d45afa1eac5e2fcc5d2c6b3c9996bb467d60d29ba0c8f200888afb3c6cf
SHA1 hash:	fc7e043bf022cb2f04e214fd35fd8d16e1e5fc3e
MD5 hash:	65b4423a94e2848ba1e202bf2b18e77e
humanhash:	comet-video-sixteen-river
File name:	WhatsApp IMG00120261110001.rar
Download:	download sample
File size:	1'333 bytes
First seen:	2026-11-09 13:28:34 UTC
Last seen:	Never
File type:	rar
MIME type:	application/vnd.rar
ssdeep	24:ZOr/qvsNkQ5ddX3mJB18lWwugsocgU2r4wvDSX7OqoSdhVEvMoVNb:ZS/Ksyodtm/17U1cgvrj7SXadSjVE9zb
TLSH	T1F021D851D2107A338421809046CAF644693B4BBFDCA9BC80D23F3A63A17A455DB2E633
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	qemped
Tags:	rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

ID

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	WhatsApp IMG00120261110001.js
File size:	4'767 bytes
SHA256 hash:	7f558a9c7e1211746659147e2bb34fd85a0bddf06d1c574b147b9ac8bbec5687
MD5 hash:	73d807d59b930feb82278d297b20c015
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3f03c4e6-aa86-4f65-a4f6-152a7a285784/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af1c23cac89c90fc65a88d4

Tags:

virus small crypt

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes aspnet_compiler base64 crypto encrypted evasive lolbin obfuscated opendir packed powershell reconnaissance repaired

Link:

https://www.filescan.io/uploads/6af1cc141f080b6d1667f6e6/reports/443ff666-aacb-4bd7-9342-b5b20ad174c4/overview

Hybrid Analysis HEUR/Suspar.Generic

Verdict:

Suspicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/6a1362fa7088d9eb063f1abb03bc04cd15ea2a2c8f5e64859a9d1bb3acc6275b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

Link:

https://opentip.kaspersky.com/6a1362fa7088d9eb063f1abb03bc04cd15ea2a2c8f5e64859a9d1bb3acc6275b/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/65b4423a94e2848ba1e202bf2b18e77e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6a1362fa7088d9eb063f1abb03bc04cd15ea2a2c8f5e64859a9d1bb3acc6275b/

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-09 03:17:46 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

9 of 36 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nijwf6tqrdm6wbr7dk5qhpaezuk6ukrmr5pgjbm2tun3hlgge5nq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261109-vm19rady2j/

Behaviour

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Badlisted process makes network request

VirusSign suspar

Malware Family:

suspar

Alert

Create hunting rule

Malicious:

True

Tags:

rar

Link:

https://intel.virussign.com/intelligence/file/6a1362fa7088d9eb063f1abb03bc04cd15ea2a2c8f5e64859a9d1bb3acc6275b

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6a1362fa7088d9eb063f1abb03bc04cd15ea2a2c8f5e64859a9d1bb3acc6275b