MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655
SHA3-384 hash:	8a4e2c55469f30884f94749e976eac0784a3830da02668023e2c822e473b8f672049c4d804b56a54aaca0e51dc704739
SHA1 hash:	e3f44486e385477bdebb4b215a059fbb8c56becb
MD5 hash:	9bac6e63199a047845962a492defe910
humanhash:	seventeen-fix-eleven-vegan
File name:	OHPYYBSL.msi
Download:	download sample
Signature	HijackLoader Alert Create hunting rule
File size:	2'310'144 bytes
First seen:	2025-10-28 22:02:55 UTC
Last seen:	2025-10-29 04:36:05 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	49152:P2Rl4DKw9I7pSkTX8rAv6u6Lcs3KwY8X5ieigDLgS:RD9I7rjxJI3gY5p
Threatray	471 similar samples on MalwareBazaar
TLSH	T170B53301706D02A2D1141A7A7B8097BDC9D0FFFE1B2012CEB896F36F697286D25B35D6
TrID	88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	juroots
Tags:	HIjackLoader msi

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

53

Origin country :

CH

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/34557/

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69013dbd706befaf4ec9d048

Tags:

obfusc overt crypt

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-debug installer installer wix

Link:

https://www.filescan.io/uploads/69013dbeb33c704cbf93c386/reports/2c7e9a25-cd7f-44dd-a0d9-a783abd7789b/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

msi

First seen:

2025-10-28T12:17:00Z UTC

Last seen:

2025-10-28T13:43:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655/results?tab=lookup

Nucleon Malprob Benign

Score:

9%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655/

Neiki Family.RHADAMANTHYS

Verdict:

Malicious

Threat:

Family.RHADAMANTHYS

Link:

https://tip.neiki.dev/file/25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ewzu66q2u2cfrikqdavcukjouyn4hjc2oj4cqop5yc7froil2zkq._file

Threatray hijackloader rhadamanthys

Verdict:

malicious

Label(s):

hijackloader

Alert

Create hunting rule

rhadamanthys

Alert

Create hunting rule

Similar samples:

1826267238e6d603aa8c6db5c6d968da2cb2e6d522e6b92382170cbb6e098e28

HijackLoader

56cf64ca5d71f829a5db031b0ea02ad7aaf9cafe881fbbe30487bd5dccf7a4f6

HijackLoader

650b208d0e906556d2c926006f054e4f66e012397760d4235309580e977462c0

HijackLoader

78fa33a83e427eaa269af6c303c5b0f8ee72aa9af27032508d44cd2c1f35070f

HijackLoader

7f2b86e0352b6ceddfdbc7d74cd277cc1b084a673a6c9e6a1a4e0e341d6f0e36

HijackLoader

9b0ee330b58584603c1d1510bfeee549e128ecc7867e2c38ea6ca71c5fd3c89d

HijackLoader

bf33db6a8ff34a86e6d839ddf5dc5d96a0f09e114bf8b1bf3fce413317d2622a

HijackLoader

c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7

HijackLoader

c4e7a48ffde4a42c8161f3a11838bc10ebe1007725c3b415e66a88ec270eae23

HijackLoader

d04137545cebb0c8bdfe0f28ac6489fba6b1be235a120cf572c5f014d2259de6

HijackLoader

error

HijackLoader

+ 461 additional samples on MalwareBazaar

Hatching Triage hijackloader

Result

Malware family:

hijackloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:hijackloader discovery loader persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/251028-1yn2fsb16b/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Checks SCSI registry key(s)

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Enumerates connected drives

Detects HijackLoader (aka IDAT Loader)

HijackLoader

Hijackloader family

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/6e095487-c6de-4a25-8083-0e73e7a660b1

VMRay IDATLoader

Malware family:

IDATLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/25b34f7a1aa6/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HijackLoader

msi 25b34f7a1aa68458a150182a2a292ea61bc3a45a72782839fdc0be58b90bd655

(this sample)

Cape

https://www.capesandbox.com/analysis/34557/

  

URLhaus

https://urlhaus.abuse.ch/url/3690055/

  

Delivery method

Distributed via web download