MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0641558e2b0c3da8e7baaaa2d56577499e10db8dc1b106d90aa6abed845af250. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0641558e2b0c3da8e7baaaa2d56577499e10db8dc1b106d90aa6abed845af250
SHA3-384 hash: 534155f1f1778929b2372378dfe1f9c887fd9f251f2b40d5b615fa1318f3c22afbaaaef0326eb027ee5bec71c45ee561
SHA1 hash: 5aec1d8243bd98f3497b6e861d36a255328e426f
MD5 hash: 7c8aaa9dc920c8b1e8f0682031957e3e
humanhash: cup-tennessee-lemon-music
File name:Setup_2_3.msi
Download: download sample
File size:28'762'112 bytes
First seen:2026-06-04 06:09:26 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 786432:cKGfs6Zm84ElYg/e7HrQcuZNZTNETs219Ub:Kb4wY97Hcckt219Ub
TLSH T1CF5733ADD9565747E63FD870C57082299332BC525A13C916A25C33A32CBFBF622F809D
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter lfr
Tags:msi


Avatar
lfr
http://gitchupdaterr.pages.dev/
https://gitchupdaterr.pages.dev/
https://github.com/maggieyonah86/xcb/releases/download/soft/Updater_v2.3.zip

https://www.virustotal.com/gui/file/fa24589d8e1a0745d02960caf3a10a54df301acbbce2cf1ecf457a3c3adcba64/detection
https://www.virustotal.com/gui/file/923966dbf48dc730d5ea2399d89bff0cc68cd1162e2f30c122fdcfc9d9a4de8a/detection
https://www.virustotal.com/gui/file/0641558e2b0c3da8e7baaaa2d56577499e10db8dc1b106d90aa6abed845af250/detection
https://www.virustotal.com/gui/file/7306b9a51c11e27228cab404f2d5fe69e364e382b319bf07634962a6e4d79c42/detection
https://www.virustotal.com/gui/file/af07e6d14cba16d5ef459fbfeedef5d1a1fc9f8d5ab96f20a98d0bd0318ac5a4/detection

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
FR FR
Vendor Threat Intelligence
Gathering data
Detection:
WinosStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68944/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2116b9f8676ad4d360ea68
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug CAB crypto encrypted expand fingerprint installer installer lolbin reconnaissance signed
Link:
https://www.filescan.io/uploads/6a2116a246e44aecc0ce07e2/reports/7bed31fd-5fdc-4ef5-80df-854365664575/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/0641558e2b0c3da8e7baaaa2d56577499e10db8dc1b106d90aa6abed845af250
Verdict:
Malicious
File Type:
msi
First seen:
2026-06-04T22:13:00Z UTC
Last seen:
2026-06-04T22:23:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Script.Agent.gen
Link:
https://opentip.kaspersky.com/0641558e2b0c3da8e7baaaa2d56577499e10db8dc1b106d90aa6abed845af250/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/0641558e2b0c3da8e7baaaa2d56577499e10db8dc1b106d90aa6abed845af250
Gathering data
Gathering data
Verdict:
Susipicious
Link:
https://tip.neiki.dev/file/0641558e2b0c3da8e7baaaa2d56577499e10db8dc1b106d90aa6abed845af250
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=azavldrlbq62rz52vkrnkzlxjgpbbw4nygyqnwiku2v63bc26jia._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/260604-gwvxfabv2m/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Badlisted process makes network request
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 0641558e2b0c3da8e7baaaa2d56577499e10db8dc1b106d90aa6abed845af250

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/68944/

Comments