MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae6bb36316ba20413015d7879e2893a60af275e54dcf8ecc709af58e23f4e79f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments

SHA256 hash:	ae6bb36316ba20413015d7879e2893a60af275e54dcf8ecc709af58e23f4e79f
SHA3-384 hash:	9e3685e1ed6a9b103e878483fe6d15fe85b048f9ca620b54596a2061187bc86de3c23929281fc41a9712130b0beced9d
SHA1 hash:	51a6d3dd34c42963111e02f18c874ab07c7a4f96
MD5 hash:	1862c007aebbe275e3d0a77dd6ffac46
humanhash:	table-winner-oscar-emma
File name:	1.dll
Download:	download sample
File size:	232'960 bytes
First seen:	2026-05-16 16:42:34 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	b1b263f68eec482fb9a8f81943d792f3
ssdeep	6144:QWMAOCuuF8or3ZPKtH8y211YO987N7TNKDV:ucuI8or3VUzOM7TNK
TLSH	T19B347C00F4C1C072D9BF153249389BB65A7DB9604BE559DFABE80D6E4F303C1D631AAA
TrID	22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win64 Executable (generic) (6522/11/2) 17.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.7% (.EXE) Win32 Executable (generic) (4504/4/1) 7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	BlinkzSec

Intelligence

File Origin

# of uploads :

# of downloads :

154

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/66131/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.937587.19141952.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a089e9c46d6967b3d90b2c6

Tags:

malware

Verdict:

Malicious

Labled as:

Fragtor.Generic

Link:

https://www.hybrid-analysis.com/sample/ae6bb36316ba20413015d7879e2893a60af275e54dcf8ecc709af58e23f4e79f

Verdict:

Clean

File Type:

dll x32

First seen:

2026-05-16T13:52:00Z UTC

Last seen:

2026-05-16T21:17:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ae6bb36316ba20413015d7879e2893a60af275e54dcf8ecc709af58e23f4e79f/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/9dc12e5d-5a1c-473c-bc93-35d7dac1db5e

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ae6bb36316ba20413015d7879e2893a60af275e54dcf8ecc709af58e23f4e79f

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/1862c007aebbe275e3d0a77dd6ffac46

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ae6bb36316ba20413015d7879e2893a60af275e54dcf8ecc709af58e23f4e79f/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/ae6bb36316ba20413015d7879e2893a60af275e54dcf8ecc709af58e23f4e79f

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2026-05-15 05:39:00 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

26 of 37 (70.27%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vzv3gyywxiqecmav26dz4ketuyfpe5pfjxhy5tdqtl2y4i7u46pq._file

Gathering data

Unpacked files

SH256 hash:

ae6bb36316ba20413015d7879e2893a60af275e54dcf8ecc709af58e23f4e79f

MD5 hash:

1862c007aebbe275e3d0a77dd6ffac46

SHA1 hash:

51a6d3dd34c42963111e02f18c874ab07c7a4f96

Link:

https://www.unpac.me/results/340e19f6-d3e6-47e4-af54-f828bf536a55/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ae6bb36316ba20413015d7879e2893a60af275e54dcf8ecc709af58e23f4e79f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.