MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


EternalRocks


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5
SHA3-384 hash: 39996a4a68144b98fad026e92f9fdad37203e05600d9d931c456080ec23d26c3a9e769c23f1efd43a849b36e9a46cc85
SHA1 hash: 9b356fc67f88e711eb997c8712c13ec319116853
MD5 hash: 8149eb8784a27fedccd9efc62adffc96
humanhash: zulu-cola-high-low
File name:file
Download: download sample
Signature EternalRocks
Create hunting rule
File size:1'462'272 bytes
First seen:2026-03-19 17:21:04 UTC
Last seen:2026-03-22 18:17:51 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 24576:eUkZ+vMII/DOqPxic4ShwCczA6Vuv17QKnCC7fyOC4LhHaX1gJccghhCkbY7W366:zk8XGN2SSCz6KnC6ap4LVaX+JXcEkbYt
TLSH T1DB653353309C9F6CD48011BF2543F280BEFADD84FA6085076C487B96B6B5CE996785CE
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Bitsight
Tags:dropped-by-amadey EternalRocks fbf543 msi


Avatar
Bitsight
url: http://158.94.208.7/files/7850695435/gpaMBVQ.msi

Intelligence

File Origin
# of uploads :
53
# of downloads :
82
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
MSI
an embedded setup program or component
Link:
https://research.acce.ciphertechsolutions.com/results/2dfeeb00-71a9-4216-b102-a8df926ab918/
Gathering data
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69bc30d593b644ca466bc04f
Tags:
shell spawn sage
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5
Verdict:
Malicious
File Type:
msi
Detections:
Trojan.PowerShell.Cobalt.sb PDM:Trojan.Win32.Generic HEUR:Trojan.BAT.Cobalt.gen
Link:
https://opentip.kaspersky.com/de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5/results?tab=lookup
Score:
87%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-03-19 17:22:28 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
4 of 38 (10.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3zvite2lbgz2befd45boin23gzvfnkntvujnkejl4k2wymjez22q._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/260319-vw9x9ahx3k/
Behaviour
Checks SCSI registry key(s)
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
System Network Configuration Discovery: Internet Connection Discovery
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Enumerates connected drives
Looks up external IP address via web service
Checks computer location settings
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/de6a89934b09/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

EternalRocks

Microsoft Software Installer (MSI) msi de6a89934b09b3a090a3e742e4375b366a56a9b3ad12d5112be2b56c3124ceb5

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3799917/
Cape
Cape
https://www.capesandbox.com/analysis/58207/

Comments