MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 099f1c2b33089a9e0160dacdead3c63bb3d18430aec5c4c280de62a93334e62b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 099f1c2b33089a9e0160dacdead3c63bb3d18430aec5c4c280de62a93334e62b
SHA3-384 hash: 0720098ba5d2e829bbafa21f510d021a4d97f9ac1fd541db13168c7a16dcc386f395e71c3fee9f8e3b715cf68c6de0a2
SHA1 hash: 0603de6509b352233a57a70b396c54c300da8156
MD5 hash: 2cf74eeffdfa626b5a2874b7c1e548cd
humanhash: north-potato-robin-hotel
File name:firefox-143.0.ru.win64.installer.exe
Download: download sample
File size:82'781'436 bytes
First seen:2025-09-14 13:20:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 05d3dce2be32df01ca249872dd2cc117 (1 x GuLoader, 1 x HijackLoader)
ssdeep 1572864:F8Gu7OyTnQS8bwNdTNeXRjtmcpkpttCVqlyoiSE6zYLA+SkgAdUiRw:OGu78bwz5QjtfihXjjEyY1ldUi2
TLSH T13E08334125B4591BDF2B4EFDA929E2F0153A1EB869B208B4024B3FF53AF117C2887DD5
TrID 39.9% (.EXE) UPX compressed Win32 Executable (27066/9/6)
24.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Gasr
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
firefox-143.0.ru.win64.installer.exe
Verdict:
Malicious activity
Analysis date:
2025-09-14 13:07:24 UTC
Tags:
upx
Link:
https://app.any.run/tasks/c257e0a4-b566-4309-b7d3-954e48f64f5d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c6be0fe579c633a4b533bd
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
installer microsoft_visual_cc overlay overlay packed packed packed upx
Link:
https://www.filescan.io/uploads/68c6c158c62f6996238988be/reports/c89718b5-3e2f-4001-9127-5caec3c640a7/overview
Verdict:
Suspicious
Labled as:
Malware_49.4
Link:
https://www.hybrid-analysis.com/sample/099f1c2b33089a9e0160dacdead3c63bb3d18430aec5c4c280de62a93334e62b
Verdict:
Clean
File Type:
exe x32
Link:
https://opentip.kaspersky.com/099f1c2b33089a9e0160dacdead3c63bb3d18430aec5c4c280de62a93334e62b/results?tab=lookup
Score:
23%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/099f1c2b33089a9e0160dacdead3c63bb3d18430aec5c4c280de62a93334e62b
Gathering data
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/099f1c2b33089a9e0160dacdead3c63bb3d18430aec5c4c280de62a93334e62b
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bgprykztbcnj4ala3lg6vu6ghoz5dbbqv3c4jqua3zrksmzu4yvq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery upx
Link:
https://tria.ge/reports/250914-qlqz6swwfw/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
UPX packed file
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/463fffe4-7caf-4de4-9928-05d437b10eb4
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments