MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e
SHA3-384 hash: 8ba2a46d92f848d34676adea0683da85db35c109a82dc348fdb3e420c73b7c8fbfe36ffa7059568d00ef9c93ca2c3eaf
SHA1 hash: e703e1b8c2da14ca54ed0343a8a8db80688f9057
MD5 hash: c46e2ae5a068439e70a857f942baa604
humanhash: eleven-washington-sierra-sweet
File name:UTODYIBG.msi
Download: download sample
File size:9'207'808 bytes
First seen:2026-08-25 19:43:26 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:V9LuzXp14IgOL43JUeh9Ey/KnzAQZwYaaBIuLIUZkHfvOxDEsIf8BvM:VcjravUehT/KnzFuYDBzRLgf8K
TLSH T19D9633B473605384E71FACF264681168A1E8CE667971505B6F0AB8B2F773E736910BF0
TrID 68.9% (.MST) Windows SDK Setup Transform script (61000/1/5)
22.0% (.WPS) Kingsoft WPS Office document (alt.) (19502/3/2)
9.0% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter aachum
Tags:ClickFix HIjackLoader msi SnappyClient softwareinformsdk-com


Avatar
iamaachum
https://pub-08f0c43713544017a76e18f98cedda63.r2.dev/Phil-Verify-Cloudflare-Challange-v10.html => file://///imserbl.com/jons/4339UTODYIBG/UTODYIBG.msi

SnappyClient C2: softwareinformsdk.com (199.247.18.121:3333)

Intelligence

File Origin
# of uploads :
1
# of downloads :
42
Origin country :
ES ES
Vendor Threat Intelligence
Malware configuration found for:
HijackLoader MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f5e97277-21be-42ac-b776-729363f9ae7c/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/82782/
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-debug expired-cert fingerprint installer reconnaissance wix
Link:
https://www.filescan.io/uploads/6a8df087f0ebe75274710ffc/reports/4f6e2636-1b16-4c19-93b3-e3938fdefc2c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e
Result
Threat name:
HijackLoader, SnappyClient
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1963645
Signature
Antivirus detection for dropped file
Contains VNC / remote desktop functionality (version string found)
Found API chain indicative of debugger detection
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Unusual module load detection (module proxying)
Yara detected HijackLoader
Yara detected SnappyClient
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1963645 Sample: UTODYIBG.msi Startdate: 25/08/2026 Architecture: WINDOWS Score: 100 50 softwareinformsdk.com 2->50 52 example.com 2->52 60 Found malware configuration 2->60 62 Antivirus detection for dropped file 2->62 64 Yara detected SnappyClient 2->64 66 Yara detected HijackLoader 2->66 9 msiexec.exe 83 43 2->9         started        12 msiexec.exe 3 2->12         started        signatures3 process4 file5 34 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 9->34 dropped 36 C:\Users\user\AppData\Local\...\msvcr100.dll, PE32 9->36 dropped 38 C:\Users\user\AppData\Local\...\msvcp_win.dll, PE32 9->38 dropped 40 4 other malicious files 9->40 dropped 14 Encrypted-Injector.exe 10 9->14         started        process6 file7 42 C:\ProgramData\...\ucrtbase.dll, PE32 14->42 dropped 44 C:\ProgramData\...\msvcr100.dll, PE32 14->44 dropped 46 C:\ProgramData\...\msvcp_win.dll, PE32 14->46 dropped 48 4 other malicious files 14->48 dropped 84 Found API chain indicative of debugger detection 14->84 86 Switches to a custom stack to bypass stack traces 14->86 88 Found direct / indirect Syscall (likely to bypass EDR) 14->88 18 Encrypted-Injector.exe 7 14->18         started        signatures8 process9 file10 28 C:\Users\user\AppData\Roaming\...\memu.exe, PE32 18->28 dropped 30 C:\Users\user\AppData\Local\Temp\BCD76D.tmp, PE32 18->30 dropped 32 C:\ProgramData\SpectruArray.exe, PE32 18->32 dropped 68 Found API chain indicative of debugger detection 18->68 70 Contains VNC / remote desktop functionality (version string found) 18->70 72 Found hidden mapped module (file has been removed from disk) 18->72 74 3 other signatures 18->74 22 SpectruArray.exe 5 18->22         started        26 memu.exe 3 18->26         started        signatures11 process12 dnsIp13 54 example.com 172.66.147.243, 49716, 49720, 49724 CLOUDFLARENET-CloudflareIncUS Canada 22->54 56 softwareinformsdk.com 199.247.18.121, 3333, 49712, 49713 AS-VULTR-TheConstantCompanyLLCUS Germany 22->56 58 127.0.0.1 unknown unknown 22->58 76 Contains VNC / remote desktop functionality (version string found) 22->76 78 Unusual module load detection (module proxying) 22->78 80 Switches to a custom stack to bypass stack traces 22->80 82 Found direct / indirect Syscall (likely to bypass EDR) 22->82 signatures14
Score:
2%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:LZX Executable Office Document PDB Path PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/c46e2ae5a068439e70a857f942baa604
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5ccqtefxzdx42ljnboaf4ycgzxsf64pfqvdvqfs3wojtyoe4z7a._file
Verdict:
malicious
Label(s):
HijackLoader
Create hunting rule
Link:
https://reports.threatray.com/494c2c35-d098-4e05-84a8-dc5c49bec958
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader credential_access discovery loader persistence privilege_escalation ransomware spyware stealer
Link:
https://tria.ge/reports/260825-yft4msdr3x/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Malware family:
HijackLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1f44284c85be/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e

(this sample)

  
Link
https://tria.ge/260825-x77ndadq6x/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/82782/

Comments