MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea6a0df56f91552d3030b0a3db6358fbe83e92895e7bf58188f34efa5e1093a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 13 File information Comments

SHA256 hash:	ea6a0df56f91552d3030b0a3db6358fbe83e92895e7bf58188f34efa5e1093a5
SHA3-384 hash:	c37c03dc1b1e61297634c95710d2a961de5c1fe0d481cfd500e74f790860a7b062c9446d0517e0b7e9021bfa1bf396c8
SHA1 hash:	61670f724cd74cfe29384502050b50dc6da369e0
MD5 hash:	b6562ac5a4f7885c1a995999336cd3aa
humanhash:	zebra-arizona-nineteen-quiet
File name:	ea6a0df56f91552d3030b0a3db6358fbe83e92895e7bf58188f34efa5e1093a5.bin
Download:	download sample
File size:	105'248 bytes
First seen:	2026-09-29 12:16:09 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1536:TC0I5lsjvpexIKqNVQFc2DT6E//F39CLA9ylvat1snH9gPSsfB3oSIcilBNy:u0Sl2v66V+T6utCL9CtOH9+SaVITfNy
TLSH	T133A312E563FEAC7DD673308D8563152C3900A0E704AE2BADB53882C955B9B47D82C29F
Magika	zip
Reporter	whack_sh
Tags:	zip

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	ArabProgrammerLibrary.exe
File size:	138'240 bytes
SHA256 hash:	3e28bd14200e6096bd31f441d63ef84bc98a730b43a565ed0f7e37608d218f4b
MD5 hash:	ff1cf3453ee7fef65f2680ad83d21d2f
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/52611cfa-15be-4f7c-8dd5-b4ead2c23a47/

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/ea6a0df56f91552d3030b0a3db6358fbe83e92895e7bf58188f34efa5e1093a5/results/dashboard

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm explorer fingerprint lolbin packed ps2exe

Link:

https://www.filescan.io/uploads/6abbac0e7ed7703b3a92451c/reports/b10fe759-7a65-4510-b122-8b5bc067a4c9/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ea6a0df56f91552d3030b0a3db6358fbe83e92895e7bf58188f34efa5e1093a5

Verdict:

Unknown

File Type:

zip

First seen:

2026-08-19T08:09:00Z UTC

Last seen:

2026-08-19T08:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ea6a0df56f91552d3030b0a3db6358fbe83e92895e7bf58188f34efa5e1093a5/results?tab=lookup

Score:

97%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/260929-pmbffahb23/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Enumerates connected drives

Checks computer location settings

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Detect_Remcos_RAT Create hunting rule
Author:	daniyyell
Description:	Detects Remcos RAT payloads and commands

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	SUSP_Script_PowerShell_Hidden_Launcher Create hunting rule
Author:	Marjoriefort
Description:	Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:	Veille fraicheur 2026-09-14 / cluster misses web

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip ea6a0df56f91552d3030b0a3db6358fbe83e92895e7bf58188f34efa5e1093a5

(this sample)

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample