MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e
SHA3-384 hash: 3673a8fa9ebca3390023b237f99bc8d1be713601759ac6a0140dd56db6504556e046ac0c95cacbb99310d1d48c8e9e90
SHA1 hash: fd8ba5166b7fd87b17e8348bb2b998aadfa4dbd5
MD5 hash: 3ea6097b467a1089feacc0c1315ca98f
humanhash: nebraska-uranus-seventeen-tennis
File name:6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e
Download: download sample
File size:2'396'032 bytes
First seen:2026-03-19 17:18:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 88016fcdef7f227c62171d0afad9aae4 (5 x OffLoader, 3 x Gh0stRAT, 3 x ValleyRAT)
ssdeep 49152:+uI5hH3ILdFM6OZBxsJ3W6myN7fZVNKttwwo2:+5/H4cXaRW6myN7f3NKr
Threatray 337 similar samples on MalwareBazaar
TLSH T13FB5E03FB28B653EE06E1A3679B2E210593B766165128C5697F4C84CCF250B02E3F797
TrID 61.4% (.EXE) Inno Setup installer (107240/4/30)
23.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.7% (.EXE) Win64 Executable (generic) (6522/11/2)
2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 8c2cccccccd4f071
Reporter JAMESWT_WT
Tags:Eos-Mist-LTD exe signed

Code Signing Certificate

Organisation:Eos Mist LTD
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2026-01-08T00:00:00Z
Valid to:2027-01-08T23:59:59Z
Serial number: 7c74a3c9578969d8a164d63522f4491d
Intelligence: 21 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: e057d99a4b691a6f320f4b92a6cff77f2b93e10336edeb4d8c203998db3a4aa5
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
IT IT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/125484be-0390-4290-9e73-f47272703580/
Malware family:
n/a
ID:
1
File name:
6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e
Verdict:
No threats detected
Analysis date:
2026-03-19 17:19:50 UTC
Tags:
delphi inno installer
Link:
https://app.any.run/tasks/f870491a-e7fc-411f-a5f6-6e9dce0f7349

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58192/
Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69bc306f93b644ca466bbd32
Tags:
dropper delphi micro blic
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Gathering data
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-23T19:21:00Z UTC
Last seen:
2026-01-23T19:52:00Z UTC
Hits:
~10
Detections:
Trojan.Win64.Agent.smftof HEUR:Trojan.MSIL.Agent.gen Trojan.Win64.Agent.smfton
Link:
https://opentip.kaspersky.com/6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/37c7d4d8-3680-47c4-b84d-6e2ebff909b6
Score:
56%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e/
Verdict:
Susipicious
Link:
https://tip.neiki.dev/file/6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nwol2757litgoyh7jhpp4dkhkrvqgx7bumplwe2ofcrtms4cvbha._file
Verdict:
malicious
Label(s):
shellcode_loader_008
Create hunting rule
Similar samples:
084c4628027cd8896bc9144f36388739f98577f38f0bace678dc03a6d3db75b1
18cb2495b5e0512f8026d7fd123ae821d554d918ecd7269e9b8eb40ca2f480cc
4bb1a9591d047673fb0fbad3d7c41c2d55fbaeaeab26a61a205d278204316f7b
6064742f07e20c04ba5944cb8c3998779f8fe8d138f918040401386d78c49771
63bd2535fa047323b76cb578c8d57b16d568bc5aa3c39249ef7fde2448b336ce
74548adc0158b704c0776920cf0f8cfc2c3022b2cae56b5aae239d70df1f7d7f
e5bffd1dee2cab5893d916605ae2eb05b69610dfd424acc65fb6055c38ddb41e
error
+ 327 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  4/10
Tags:
discovery installer
Link:
https://tria.ge/reports/260319-vv261shw7k/
Behaviour
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
System Location Discovery: System Language Discovery
Executes dropped EXE
Unpacked files
SH256 hash:
e1102d2ed2d1e82b4963ac7fdeb1cf8cbc7d4cdf1432ce0a8d5b7043bdf9d862
MD5 hash:
10ecc167229e75a4025f753096e6d79f
SHA1 hash:
6f82b9927924410af7cb15f00cbb564d7e5bf920
Link:
https://www.unpac.me/results/d8b1328a-8e3c-4452-b823-455fb704d3d4/
SH256 hash:
420123caa145317e7af458e7b83996ac0bc85ec39e472258d95d897c02a755f9
MD5 hash:
4603f65d14952bf67e85f23761813890
SHA1 hash:
4509eaa5e3a2ef39741850274cf354f44579fae4
Link:
https://www.unpac.me/results/d8b1328a-8e3c-4452-b823-455fb704d3d4/
SH256 hash:
9ff205599b9eea5e561170ef0e9843a31578cbb117759d32e3c1df96d7bc9838
MD5 hash:
18e90d097704371ccb605e34f9140d8c
SHA1 hash:
ef9b13edf2eff3e23868e5b5d4d8fdfe0cc67210
Link:
https://www.unpac.me/results/d8b1328a-8e3c-4452-b823-455fb704d3d4/
SH256 hash:
c96257fd260ac3394a7f1eb6389c6dc8ec8e69a5db00a0ec21cf6989fd6835b7
MD5 hash:
4e076264a49023fa9081cdee72f8adfd
SHA1 hash:
fb8aeb568eafa688369504705463560cf0c7f9ab
Link:
https://www.unpac.me/results/d8b1328a-8e3c-4452-b823-455fb704d3d4/
SH256 hash:
6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e
MD5 hash:
3ea6097b467a1089feacc0c1315ca98f
SHA1 hash:
fd8ba5166b7fd87b17e8348bb2b998aadfa4dbd5
Link:
https://www.unpac.me/results/d8b1328a-8e3c-4452-b823-455fb704d3d4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6d9cbd7fbf5a266760ff49defe0d47546b035fe1a31ebb134e28a3364b82a84e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/58192/

Comments