MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bffe01c34b9ec6e91e6392b305ae7398918f7f996ae9858ea6c6d9b4499c6f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6bffe01c34b9ec6e91e6392b305ae7398918f7f996ae9858ea6c6d9b4499c6f0
SHA3-384 hash:	686b96980ab38cca220a8cb4e0ed256e9945279dd40f6484c5bfac1f47be752175aef2bb2f48fae3d9a89e392413b3b6
SHA1 hash:	bcedc2919ca4f8406ca11a4dbf47f254ddeaeec3
MD5 hash:	d9d11b91cfe565de49f2678fd1703818
humanhash:	island-speaker-island-nine
File name:	LostInWinter 2.1.1.msi
Download:	download sample
Signature	GenesisStealer Alert Create hunting rule
File size:	91'615'232 bytes
First seen:	2025-10-22 12:23:23 UTC
Last seen:	2025-10-28 21:09:32 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:PHR9COaCBn0J4V2Kck40dPIs0b3XL5614XTZJuILjFc7UKRSWSwIPLNw:PxYCBnC4Kl/H64lJuUKRS48N
TLSH	T10B18332AD42064B8E71E913B773F4850BB1B1BAE6B115BABA435749E1FB03310E4B75C
TrID	86.8% (.MSI) Microsoft Windows Installer (454500/1/170) 11.6% (.MST) Windows SDK Setup Transform script (61000/1/5) 1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	burger
Tags:	GenesisStealer infostealer msi

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

55

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68f8cc9f3edd081eba40b3f7

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug crypto fingerprint installer wix

Link:

https://www.filescan.io/uploads/68f8cd8f3a79800405f0e4b4/reports/0ab8f8ad-242a-481a-8a53-d673fbc69253/overview

Hybrid Analysis Trojan.MSI.Agent

Verdict:

Malicious

Labled as:

Trojan.MSI.Agent

Link:

https://www.hybrid-analysis.com/sample/6bffe01c34b9ec6e91e6392b305ae7398918f7f996ae9858ea6c6d9b4499c6f0

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

msi

Detections:

UDS:DangerousObject.Multi.Generic

Link:

https://opentip.kaspersky.com/6bffe01c34b9ec6e91e6392b305ae7398918f7f996ae9858ea6c6d9b4499c6f0/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1799773

Signature

Drops large PE files

Excessive usage of taskkill to terminate processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Obfuscated command line found

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queries sensitive system registry key value via command line tool

Sigma detected: Capture Wi-Fi password

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal WLAN passwords

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/6bffe01c34b9ec6e91e6392b305ae7398918f7f996ae9858ea6c6d9b4499c6f0

CERT.PL MWDB

Gathering data

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/6bffe01c34b9ec6e91e6392b305ae7398918f7f996ae9858ea6c6d9b4499c6f0

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=np76ahbuxhwg5epghevtawxhhgerr57zs2xjqwhknrwzwrezy3ya._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Link:

https://tria.ge/reports/251022-pmh6aadv6f/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Browser Information Discovery

Event Triggered Execution: Netsh Helper DLL

Reads user/profile data of web browsers

System Network Configuration Discovery: Wi-Fi Discovery

Drops file in Windows directory

Executes dropped EXE

Hide Artifacts: Ignore Process Interrupts

Loads dropped DLL

Checks computer location settings

Enumerates processes with tasklist

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/01186e61-904d-44d1-aade-c5d616ee4ba6

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.