MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9ebfd647cb5930c3a19c3fd66f103c06019f43aa53b8d309d31682514a9cd60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9ebfd647cb5930c3a19c3fd66f103c06019f43aa53b8d309d31682514a9cd60
SHA3-384 hash: e6527f5de5c41f2fb971394f47ce9f56b7a6bccbdee1d29c9f609750b0ff170a97d423f375f08dbd207371f3ec197d98
SHA1 hash: bb8ece7c9c74dd61df00bbdc2b91a40ec2576e90
MD5 hash: 7872fc0a3bedca13123cd072f2119b52
humanhash: mississippi-floor-mountain-washington
File name:files.zip
Download: download sample
File size:104'873 bytes
First seen:2026-03-25 16:35:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:HxXyS6pbLiMlqsL3WooymubUR2cSU74yk:Ry9Ls43joymhA/
TLSH T1FEA3124C6412BF4EFEED97981D67C1314F2C75D2B1914011DAF82822C6C4A9B2E98EFB
Magika zip
Reporter JAMESWT_WT
Tags:WsgiDAV zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
IT IT
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:as_encrypted.bin
File size:101'648 bytes
SHA256 hash: 869b721401fd595867ea3320a2709d100751f8f9d25f8a59cc28af7169325131
MD5 hash: 37100cd55e74cab57631b52a2ff8454c
MIME type:application/octet-stream
File name:as_key.bin
File size:48 bytes
SHA256 hash: 0c775d9263fff22c04d75d12b0a5d1a5b73c5a787a7dcdd34fabccdf9e0a0fe5
MD5 hash: 80db8fb9c2ddf28edccedb9869d85f9a
MIME type:application/octet-stream
File name:encrypted_loader.py
File size:8'923 bytes
SHA256 hash: 4a510219ffc0f5bc4acdf6e33d80d85d88155d88049cedaa00aaa9eed8051a3f
MD5 hash: 3c0ae99d912bfdbd85b612772917e22c
MIME type:text/x-python
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4f10cc18-1b09-4d89-b620-d9612b12855c/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c40ed8390b99647413b40b
Tags:
ransomware emotet
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/69c40ed22346b9da57a62030/reports/af0ef6cf-27cd-49f8-8f8e-0850be060028/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a9ebfd647cb5930c3a19c3fd66f103c06019f43aa53b8d309d31682514a9cd60
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/a9ebfd647cb5930c3a19c3fd66f103c06019f43aa53b8d309d31682514a9cd60
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/a9ebfd647cb5930c3a19c3fd66f103c06019f43aa53b8d309d31682514a9cd60/results?tab=lookup
Score:
2%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/a9ebfd647cb5930c3a19c3fd66f103c06019f43aa53b8d309d31682514a9cd60
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9ebfd647cb5930c3a19c3fd66f103c06019f43aa53b8d309d31682514a9cd60/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vhv72zd4wwjqyoqzyp6wn4idybqbt5b2uu5y2me5gfuckffjzvqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a9ebfd647cb5930c3a19c3fd66f103c06019f43aa53b8d309d31682514a9cd60

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip a9ebfd647cb5930c3a19c3fd66f103c06019f43aa53b8d309d31682514a9cd60

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3805286/
  
Delivery method
Distributed via web download

Comments