🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239
SHA3-384 hash: 8dc636089d696ee285501060e33d32bd46e4e0c4f21119ab9b061fd66e34d1cb096f52ee575e2a591b2db19c97e92bda
SHA1 hash: 701f2a5c8d8bdc28e51e11a12955197fbd652698
MD5 hash: b53f5d8baf6840fa3a5ea8e56d208ddf
humanhash: carpet-zulu-potato-green
File name:6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239.zip
Download: download sample
File size:134'661 bytes
First seen:2026-10-12 08:00:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:2CmTuuzmBsuMwfqJRxMEzNdwoRv1BQ5+4yi7:hAtzCwwyJkEzNdBv1Bo+47
TLSH T1C6D3C03FEC8B94A7EC876BF94B07E2C4824906A430E30545854B67F935E597EE311A2F
Magika zip
Reporter KodaDr
Tags:blinder tunnel zip


Avatar
KodaDr
\6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239.bin\DubaiAirport_Carrers_IT_Test\DubaiAirport_Carrers_IT_Test\Resources\ ------>>>

FlightManager.csproj – Weaponized Visual Studio project file
RuntimeBroker.dll – Primary RAT loader
PsProxy.dll – In-memory PowerShell execution engine

https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
LV LV
File Archive Information

This file archive contains 28 file(s), sorted by their relevance:

File name:535f6d20-489f-46d8-81fa-aa229ce5b41b.vsidx
File size:30'849 bytes
SHA256 hash: 1d1754948c42a85f4b613dfe3de8cfb100d334da956244e4b58f5ea9d6463fed
MD5 hash: 7aa7b1f67ab76b55efafa74b65bc622c
MIME type:application/octet-stream
File name:DubaiAirport_Carrers_IT_Test.csproj.AssemblyReference.cache
File size:4'061 bytes
SHA256 hash: 2b75a7ba18fefda0c8fd1ffebecca6fb8666c9cd9b0942222141e6816dfa3173
MD5 hash: 36f52f2537802d69bad5792364f3515c
MIME type:application/octet-stream
File name:RuntimeBroker.dll
File size:33'280 bytes
SHA256 hash: 53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402
MD5 hash: 2ab34636eeab843b4bcbb6e44f033eab
MIME type:application/x-dosexec
File name:VS_SDKs.exe
File size:6'144 bytes
SHA256 hash: 06d68dcb8088546cb40fb3d7e87d6a593cbdf4cc1e43017604faf786ad6dbd41
MD5 hash: 974eb3d5bd550feaea763f6d7f3f2b97
MIME type:application/x-dosexec
File name:DesignTimeResolveAssemblyReferences.cache
File size:203 bytes
SHA256 hash: 0731bc2ce4b217a283bfa0f16735d731e9265ef1dc8a4b85c5c3d5f211ac0a61
MD5 hash: 3eed88a904ac7139a5dc84d310bc88eb
MIME type:application/octet-stream
File name:DubaiAirport_Carrers_IT_Test.exe
File size:12'800 bytes
SHA256 hash: 052702d652286482863a70eaa37e4fc894f40c8b08dccf245ced46916e7f419f
MD5 hash: 9876c685f8bcf351fc06db4b98ee192e
MIME type:application/x-dosexec
File name:RuntimeBrokerApi.dll
File size:23'056 bytes
SHA256 hash: 7f04062340c1c238c0641b6421ec5eba53d7320b405502e8eb6fcad33aaf8607
MD5 hash: e81a314256f485abd65ad7e6d12a2b0b
MIME type:application/octet-stream
File name:PsProxy.dll
File size:6'144 bytes
SHA256 hash: 3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13
MD5 hash: 7244a27029d2fb104a598b40e9f284d9
MIME type:application/x-dosexec
File name:RuntimeBroker.exe
File size:16'832 bytes
SHA256 hash: 8875a41ead3b17eb8538466bfecb211a52d7ee56fa6e496b4407bdb0caa51dc5
MD5 hash: 631a27dcd49574399ea5e8256c543879
MIME type:application/x-dosexec
File name:DesignTimeResolveAssemblyReferencesInput.cache
File size:637 bytes
SHA256 hash: 4c55f268406d74e0b3c6ef15ce2b84255e5bc4e8c784eee4625570b16b854681
MD5 hash: 991cee5da322b9d567b373fe6c23001b
MIME type:application/octet-stream
File name:calc.exe
File size:49'152 bytes
SHA256 hash: 81bd48985fa1753e9e2158a7cf969141edddbd050e976801bb477e24a2a06b2a
MD5 hash: cfca921bbac5103bf369b2b1b604c13e
MIME type:application/x-dosexec
File name:DubaiAirport_Carrers_IT_Test.pdb
File size:44'544 bytes
SHA256 hash: 6cbd29884dabf3bcd81654ce4a411d454b5d7dcceabf471c2cf38af40f202a8d
MD5 hash: 8d4121e5dbf8ed07da97de7d50226122
MIME type:application/x-ms-pdb
File name:RuntimeBroker.exe.config
File size:551 bytes
SHA256 hash: 0c9869b4aa7dde55936ab8726c442368b722eb69b785ef5c8e24938a01fdee89
MD5 hash: 27b6c1c7dddb518bb197e67341dbbe1c
MIME type:text/plain
File name:Readme.md
File size:3'783 bytes
SHA256 hash: 13216e9942e15a48228005092f4e5ff8b7382d4ec73673f88c6d7b6c103cbce0
MD5 hash: cdf15be7e076870f554b34600b2dd9e9
MIME type:text/plain
File name:InputHelper.cs
File size:1'115 bytes
SHA256 hash: c187ae90e59a457fd2af993d532d397e469582ac4afb28fb12f14611bf7aedf5
MD5 hash: d3949d1b0fe8ac1e86fe095d57cecf84
MIME type:text/x-c++
File name:DubaiAirport_Carrers_IT_Test.slnx
File size:192 bytes
SHA256 hash: 9d4b61dae9e00940305c6ad7d862713025c07f27ecb5f89e59bcbd3fbcf17965
MD5 hash: d108ffdce3c12d5ecc102ea1e4d02175
MIME type:text/plain
File name:App.config
File size:184 bytes
SHA256 hash: 16286566d54d81c3721f7ecf7f426d965de364e9be2f9e628d7363b684b6fe6a
MD5 hash: 13ff21470b63470978e08e4933eb8e56
MIME type:text/xml
File name:DubaiAirport_Carrers_IT_Test.csproj.FileListAbsolute.txt
File size:971 bytes
SHA256 hash: 0702d54b03bf601019b6ad039f76ecc49b5b3e564119dfd60aebd742c8e90300
MD5 hash: 7fa504b29558607e3d2adf8741621aeb
MIME type:text/plain
File name:Menu.cs
File size:5'221 bytes
SHA256 hash: 0cf9e6495c6a76e9350c6863af4178ff8d98c63b05f060191141c2ffe0c12d28
MD5 hash: 66a7e323c9a0382c8212ae45e0412fe4
MIME type:text/x-c++
File name:Flight.cs
File size:933 bytes
SHA256 hash: 22c7ead1d3269419b5ded66b3e436d5e9b027c61d4757948e99da64815b9a419
MD5 hash: 16413e67544ba4b38089d65c0bb4a03a
MIME type:text/x-c++
File name:Program.cs
File size:952 bytes
SHA256 hash: 89a36689d3ebaf52de5b49c9138825571e725a8545ea9219d3790aed93257ff7
MD5 hash: a8cc976eef72a5c88a5d1c6e2d4a5cf7
MIME type:text/x-c++
File name:VS_SDKs.exe.config
File size:187 bytes
SHA256 hash: f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15
MD5 hash: 15c8c4ba1aa574c0c00fd45bb9cce1ab
MIME type:text/xml
File name:AssemblyInfo.cs
File size:1'300 bytes
SHA256 hash: 5273a65ce13e96d7ef4cb44a047eed049f739ff2115d83a38a693847b4cf1b66
MD5 hash: 90360bc7d73a6fda286869756a6637d5
MIME type:text/plain
File name:DocumentLayout.backup.json
File size:8'699 bytes
SHA256 hash: 6f9774498b79c97d0ad5cafab7e949ae3a78f4d41d0abf4890cd6eb03b8ca3c0
MD5 hash: c7445dbebd02d2c9608b6a7030e7bf41
MIME type:application/json
File name:DubaiAirport_Carrers_IT_Test.csproj
File size:3'045 bytes
SHA256 hash: f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9
MD5 hash: 3d809693b3d63f33126e9eb630fef8ff
MIME type:text/xml
File name:DocumentLayout.json
File size:1'683 bytes
SHA256 hash: 11030482470385d36b2296cce9adb44b27fdd05de17ec157e62cd69ad0256ff7
MD5 hash: fd57167808a3060145df4ee24da4a1c5
MIME type:application/json
File name:DubaiAirport_Carrers_IT_Test.csproj.CoreCompileInputs.cache
File size:66 bytes
SHA256 hash: 6ec2c97eeddf741a2f8dcd7b4c720c7f5a3f7afe5205ca1cf1e62d9199333e4b
MD5 hash: ec5f4f22455c52c57f8ff87887933a6d
MIME type:text/plain
File name:FlightManager.cs
File size:1'390 bytes
SHA256 hash: 2ce188f5e38fb00a6b88f95bdd86bfc99512b828af3400bb8eb8b57f97b855da
MD5 hash: ec48ee87f75fc9cffdad8ad23fce1754
MIME type:text/x-c++
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a9abc667-7fe2-46df-8057-c375800b077f/
Detection(s):
YARA.CAPE_Obfuscar.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad0f48a6f551121ba1615e7
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239
Verdict:
Malicious
File Type:
zip
First seen:
2026-04-16T11:49:00Z UTC
Last seen:
2026-10-13T18:21:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239/results?tab=lookup
Score:
89%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.00 SOS: 0.20 SOS: 0.23 SOS: 0.36 SOS: 0.44 Zip Archive
Link:
https://app.malva.re/file/b53f5d8baf6840fa3a5ea8e56d208ddf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239/
Threat name:
Win64.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-04-16 08:08:15 UTC
File Type:
Binary (Archive)
Extracted files:
149
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nz6zwm7r44xkd3phcnz2mbhm3mda3k35iicvc6ob53pj5ti72i4q._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution
Link:
https://tria.ge/reports/261012-j2wr2attfs/
Behaviour
Command and Scripting Interpreter: JavaScript
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Obfuscar
Create hunting rule
Author:kevoreilly
Description:Obfuscar xor routime
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_BlakcSeeStealer_ForgeAuto_9b0a0e39_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects BlakcSeeStealer (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_3be2a519
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments