MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f9098d9695dced5c14820b09d5ea94a6ebfd405bfc9d66ea2fce3401f82e4fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	6f9098d9695dced5c14820b09d5ea94a6ebfd405bfc9d66ea2fce3401f82e4fe
SHA3-384 hash:	00a8d94bd3f734732098c148fb6cbb8e72dda5f05b1c2c4a1a477eeff8a13eb156e61db7a21df17f74a4381606f00a7b
SHA1 hash:	13d3aec0b57543e60ac84832e75238836a54bd2e
MD5 hash:	687968d73d74d6b2fc8ecbb6e503c8ac
humanhash:	monkey-echo-solar-lion
File name:	M1.zip
Download:	download sample
File size:	20'624'966 bytes
First seen:	2025-11-05 01:08:08 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	393216:m0Hf56u+vV9r10Gb/XFyKG0PWyIArCnseCo14zI575UKV5EgPE:m0Hf56XV95VbfFyKzP3TksG14zy75rV2
TLSH	T1EA272302823AC212FB0E6FFDE699013A9958E134651E5DDF2E7057B018B1AF256F3E4D
TrID	66.6% (.XPI) Mozilla Firefox browser extension (8000/1/1) 33.3% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	skocherhan
Tags:	github-dcm-m2 zip

skocherhan

https://github.com/dcm-m2/103025/raw/refs/heads/main/M1.zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68dca7de40b7da0b4eb91080

Tags:

n/a

Gathering data

Verdict:

Suspicious

Labled as:

Virtool.Generic

Link:

https://www.hybrid-analysis.com/sample/6f9098d9695dced5c14820b09d5ea94a6ebfd405bfc9d66ea2fce3401f82e4fe

Verdict:

Malicious

File Type:

zip

First seen:

2025-11-01T06:51:00Z UTC

Last seen:

2025-11-06T05:49:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/6f9098d9695dced5c14820b09d5ea94a6ebfd405bfc9d66ea2fce3401f82e4fe/results?tab=lookup

Score:

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/