🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6fcbafeca46493a3f4686ae0b485e7837ca23d8d164e3d5e4825d798c9c076e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6fcbafeca46493a3f4686ae0b485e7837ca23d8d164e3d5e4825d798c9c076e
SHA3-384 hash: f305b615113c0876d3228c3097fba48b166bcbb9d3ef3598c72cab20975c6c61624902642d37129cb78e08c0ab262d00
SHA1 hash: 3867c18936b2edef6db51d7e5e9fd9a332327bef
MD5 hash: b2553710a28fd220205c078916558637
humanhash: triple-don-maryland-eight
File name:Bank statement_20261007.vhdx
Download: download sample
File size:37'748'736 bytes
First seen:2026-10-07 15:41:10 UTC
Last seen:Never
File type:vhdx VHDX
MIME type:application/octet-stream
ssdeep 98304:uB8qyzojcAnGIWCPEp3NBOMoNxY9J4SwEi8qmlNOZxOs3gz5da2aUydgHG:u2gv5QCv8qmlNOPtgzzcG
TLSH T1D487CF2139C1C03ED5AA13708D6DB6B963BDAD201F3581DF63C87A2D6F709D22936663
Magika iso
Reporter smica83
Tags:vhdx

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
HU HU
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:ws2help.dll
File size:4'096 bytes
SHA256 hash: ac66a26ec63c4f4775a4c4f819649f2f1220c55548ac765b267cf420715e7780
MD5 hash: ef71655f3ff5caeb7fc9cdd763c9b829
MIME type:application/x-dosexec
File name:B_3737110718.exe
File size:1'994'600 bytes
SHA256 hash: c74f55247aa2c72001024bd977c869cb5adce6f8604a4d32329f015b73ae2a49
MD5 hash: 711cd47d4524145f9c488afecc85ebc7
MIME type:application/x-dosexec
File name:a660cf61-8f45-4fdb-8946-9f65ed4bd67f.dtd
File size:2'112 bytes
SHA256 hash: aef4117ae582c212e75da8bd57e22955e1f30f07784ea3167de8aad54fd6ed4b
MD5 hash: 06ae359ea5ec3924378b904457a359fa
MIME type:application/octet-stream
File name:RIme.DLl
File size:3'520'512 bytes
SHA256 hash: 674b8a116378de55e73b566ec0bfe4ed4e41710bc755d724eb98de27b16f9902
MD5 hash: c0810369b88bd9b8b2f297a737964a33
MIME type:application/x-dosexec
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad03fcaf4e17c78f71563f0
Tags:
malware
Verdict:
Suspicious
Labled as:
Trojan.Downloader.Script
Link:
https://www.hybrid-analysis.com/sample/a6fcbafeca46493a3f4686ae0b485e7837ca23d8d164e3d5e4825d798c9c076e
Verdict:
Malicious
File Type:
discimage.vhdx
First seen:
2026-10-07T13:47:00Z UTC
Last seen:
2026-10-07T14:02:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a6fcbafeca46493a3f4686ae0b485e7837ca23d8d164e3d5e4825d798c9c076e/results?tab=lookup
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-07 11:26:43 UTC
File Type:
Binary (Archive)
Extracted files:
80
AV detection:
3 of 23 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u36lv7wkizetup2gq2xawsc6pa34ui6y2fsohvpeqjoxtde4a5xa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/a6fcbafeca46493a3f4686ae0b485e7837ca23d8d164e3d5e4825d798c9c076e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:GenericGh0st
Create hunting rule
Author:Still
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments