MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f3ba3a2f85ca82b8a3a16d9b8ae2cb3abb1f07c4fac006dada12dbf5b27b4f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	1f3ba3a2f85ca82b8a3a16d9b8ae2cb3abb1f07c4fac006dada12dbf5b27b4f7
SHA3-384 hash:	58f82dd9c2b5c72c83f1454051fbcb7f1ea8da574de26caf67f7950aa861aeb642b0b4a75113f827d78cd1a97cc0ac29
SHA1 hash:	9544a471adc7bee837c6d1742a617449b02fcfee
MD5 hash:	d47be1fe5acfa08c42d4513873228573
humanhash:	alanine-winner-blue-october
File name:	setup.msi
Download:	download sample
File size:	33'699'328 bytes
First seen:	2025-03-21 21:00:03 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	786432:qFTMlB9esBU2upt5pycYi4WD4o3mtiJ4+oJ2SpM765dhQ3c8qVroF/wn:qFTMlrefp7j7j4o3nipMi28+8
TLSH	T130773331BD9E8036EA5F47B2A53AAA2AA43D2DD23B7344DB53E0F45615314C39334B87
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	aachum
Tags:	msi

iamaachum

https://github.com/bozario111/page1/raw/refs/heads/main/setup.msi

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ddd478115e7b48b48f88f0

Tags:

virus agent msil

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm cmd evasive expired-cert fingerprint fingerprint keylogger lolbin remote wix

Link:

https://www.filescan.io/uploads/67ddd367e05c48ec61e5c5ee/reports/2a607679-5fc4-4e78-a8d4-7aea75cc48a2/overview

Verdict:

Suspicious

Labled as:

TR/Agent.immot

Link:

https://www.hybrid-analysis.com/sample/1f3ba3a2f85ca82b8a3a16d9b8ae2cb3abb1f07c4fac006dada12dbf5b27b4f7

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/1f3ba3a2f85ca82b8a3a16d9b8ae2cb3abb1f07c4fac006dada12dbf5b27b4f7

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1645555

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

59%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250321-ztdt9azsg1/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Loads dropped DLL

Enumerates connected drives

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5f576d0b-2404-43d4-b5ad-86d36d1fb670

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1f3ba3a2f85ca82b8a3a16d9b8ae2cb3abb1f07c4fac006dada12dbf5b27b4f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_LATAM_MSI_Banker Create hunting rule

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	suspicious_msi_file Create hunting rule
Author:	Johnk3r
Description:	Detects common strings, DLL and API in Banker_BR

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)