MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0f28e993fb49f2ec8ba040338c9d68d625935303652ca02b4922927bcace8fee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 0f28e993fb49f2ec8ba040338c9d68d625935303652ca02b4922927bcace8fee |
|---|---|
| SHA3-384 hash: | b1a181e2fb0a8b89eec8ff4d2b2f2bbe9bb90a9a187e0f8793a1860d98107f5215fb6b1460431307c7321e22db2e0af0 |
| SHA1 hash: | cf77b282c7b84232817785f336258dfabed94e0f |
| MD5 hash: | 0badba5392eb7c974f18b7349559a57a |
| humanhash: | washington-winter-ceiling-uniform |
| File name: | file |
| Download: | download sample |
| File size: | 46'080 bytes |
| First seen: | 2026-10-21 10:03:05 UTC |
| Last seen: | 2026-10-21 10:32:13 UTC |
| File type: |  msi |
| MIME type: | application/x-msi |
| ssdeep | 768:IM72lXcYM/mgRroNJ9Vn3RrTpCNUXiD0JKScDDwKJeTUrJfvVl9yK0zoNURQ:I51gbroNJ9VBrwNKCRScHvthydom+ |
| TLSH | T10C23E1417551CA6BE758FB3A8E9B9BE10720FC54DE0505127BA2335D5EB32893D263CC |
| TrID | 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1) |
| Magika | doc |
| Reporter |  Bitsight |
| Tags: | 9d2ca3 dropped-by-amadey msi |
Intelligence
File Origin
# of uploads :
3
# of downloads :
73
Origin country :
USVendor Threat Intelligence
Malware configuration found for:
MSI
Details
Detection:
n/a
Verdict:
Malicious
Score:
92.5%
Tags:
xtreme rapid shell sage
Verdict:
Unknown
Threat level:
0/10
Confidence:
100%
Tags:
wix
Verdict:
Malicious
File Type:
msi
First seen:
2026-10-21T07:55:00Z UTC
Last seen:
2026-10-22T03:47:00Z UTC
Hits:
~10
Score:
5%
Verdict:
Benign
File Type:
ARCHIVE
Verdict:
Malware
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:MSZIP COM Behavior Trace DeObfuscated Obfuscated Office Document PowerShell Scripting.FileSystemObject SOS: 0.27 T1027 T1059 T1059.001 T1059.005 T1105 VBScript WScript.Shell
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2026-10-21 10:03:18 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
7 of 24 (29.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery execution persistence privilege_escalation ransomware
Behaviour
cURL User-Agent
Uses Volume Shadow Copy service COM API
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
Runs ping.exe
Modifies registry key
Modifies registry class
Modifies data under HKEY_USERS
Checks processor information in registry
Checks SCSI registry key(s)
System Network Configuration Discovery: Internet Connection Discovery
Reads the TCP/IP host and domain name from the registry
Executes a command shell one-liner
Event Triggered Execution: Installer Packages
Enumerates physical storage devices
Queries registry keys for unique system GUIDs
Drops file in Windows directory
Drops file in Program Files directory
Executes a VBScript file via the Windows Script Host.
Discovers running processes
Enumerates connected drives
Adds Run key to start application
Modifies file permissions
Executes dropped EXE
Checks computer location settings
Drops file in Drivers directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
msi 0f28e993fb49f2ec8ba040338c9d68d625935303652ca02b4922927bcace8fee
(this sample)
Dropped by
Amadey
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.