MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba8163e2256d9feec983aa780ee262d4b4d5dbe07790070ce8c9899389491cf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


EternalRocks


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba8163e2256d9feec983aa780ee262d4b4d5dbe07790070ce8c9899389491cf7
SHA3-384 hash: 91334ae072cbab2e438ff17fd3f52fc98d3c56237594d627729bd45cce72dc2cfb98bffdd9b0d4c93ede682e3d2cb8b7
SHA1 hash: b5a49e49a76f3fd9fd88aa2213b89d448907bdcf
MD5 hash: c120a6ebac4cc908057922f1c1cabc68
humanhash: march-seven-queen-bacon
File name:Microsoft-Activation-Scripts.msi
Download: download sample
Signature EternalRocks
Create hunting rule
File size:78'671'343 bytes
First seen:2026-07-05 09:27:25 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 1572864:K9DTAlFH3/HJC6HWgwNpgReoq765aOWRnxd4C9WzAQKe8FL7LeiJqsKmYMo8DUjx:AnO/I5DgRe9765a/N/QAQKDnapsurTt
Threatray 54 similar samples on MalwareBazaar
TLSH T14B083378A4990D75D5B9563FCA3B993823213F319BE2506B4661F2062CFF0E05BF2E52
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Alex_sev
Tags:agent bat EternalRocks Generic msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
AU AU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6046b2d0-2c66-4387-b62f-08874b0bd8f4/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4a239e762b0b26f3d015cf
Tags:
virus spawn
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug CAB cmd evasive expand expired-cert installer installer lolbin msiexec packed ping powershell reconnaissance
Link:
https://www.filescan.io/uploads/6a4a238faeee0afd2435ca08/reports/0858bac4-d845-4e12-acbb-8ed0c700fa6c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/ba8163e2256d9feec983aa780ee262d4b4d5dbe07790070ce8c9899389491cf7
Verdict:
Clean
File Type:
msi
Link:
https://opentip.kaspersky.com/ba8163e2256d9feec983aa780ee262d4b4d5dbe07790070ce8c9899389491cf7/results?tab=lookup
Gathering data
Verdict:
Susipicious
Link:
https://tip.neiki.dev/file/ba8163e2256d9feec983aa780ee262d4b4d5dbe07790070ce8c9899389491cf7
Threat name:
Script-BAT.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-06-15 11:59:14 UTC
File Type:
Binary (Archive)
Extracted files:
893
AV detection:
10 of 24 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkawhyrfnwp65smdvj4a5ytc2s2nlw7ao6iaodhizgezhckjdt3q._file
Verdict:
malicious
Label(s):
covenantc2
Create hunting rule
Similar samples:
0492b2bc8b7abffd4c3017299bd9ff3c1d687bb558f25a1975e66f683ffbabea
EternalRocks
0f2dd6e00dccd744d181419ecc6179f55aed09e54f2c4633d759feb51c2500e1
EternalRocks
3db1d7b1a464bd1b2cc71211f35ff9ad4222ecb5809ac86d5b5d0eba9e83e7ca
EternalRocks
3f7ef9bab42d3524fa5748b408d92d8e860065b4262f7f957b9a6b440c8a428e
EternalRocks
4ef4742c1a71cca9a3bfc4fe312e9ca6df120fec15f4f8dea4266f17340837b0
EternalRocks
7d4236cb1086869a7f2b1afc96bfcd45e0f9da4970427f57f2ff89e0f533e422
EternalRocks
a22d583c9cccac570226f4dabe0eef59e3473581fd71ba11eb3e400f58a2be91
EternalRocks
c96b83fa0b190f3e09f92507e04b821b98eeed9f51a866a75c188ff08baa3b36
EternalRocks
d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f
EternalRocks
error
EternalRocks
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/260705-le5grsbt7w/
Behaviour
Checks SCSI registry key(s)
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Enumerates connected drives
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_SliverFox_String
Create hunting rule
Author:huoji
Description:Detect files is `SliverFox` malware
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments