MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26d6fa845d4f76674f96deb7e3f01a610d9224a103baf8d395d7eab16fc3fe61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	26d6fa845d4f76674f96deb7e3f01a610d9224a103baf8d395d7eab16fc3fe61
SHA3-384 hash:	fc8b176432d889c86a8c3ba14bb85a6d165a78fd0bbc41c24cb74544660fddeaaa960b698ab6e7258e6110a9eb8ea87f
SHA1 hash:	325225e0ed81c0175dd08a7e177a10f683342b37
MD5 hash:	2bb2e271ee4574ea07adff49321f68a0
humanhash:	mississippi-table-mexico-colorado
File name:	RDCMan.msi
Download:	download sample
File size:	121'561'088 bytes
First seen:	2026-10-10 18:43:24 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	3145728:UdB0lnkCZBmt/akExGVNorK7yQEp3C3HG6guMN191qnfNOjvM:UcJpZMtkxIorK7yQEpS3HDguQ19Uog
TLSH	T17748330DBC193DA7D3637F38269A4B468F7221220B410261966FCA1FDEFEE5565B90C3
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	SquiblydooBlog
Tags:	msi signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

237

Origin country :

US

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad0b1d8f4e17c78f715b32e

Tags:

n/a

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/26d6fa845d4f76674f96deb7e3f01a610d9224a103baf8d395d7eab16fc3fe61

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

msi

First seen:

2026-10-11T17:48:00Z UTC

Last seen:

2026-10-12T16:21:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/26d6fa845d4f76674f96deb7e3f01a610d9224a103baf8d395d7eab16fc3fe61/results?tab=lookup

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/26d6fa845d4f76674f96deb7e3f01a610d9224a103baf8d395d7eab16fc3fe61

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e3lpvbc5j53got4w3236h4a2megzejfbao5pru4v27vlc36d7zqq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/261010-xdlh2s1t3j/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

Command and Scripting Interpreter: PowerShell

Event Triggered Execution: Installer Packages

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Drops file in Windows directory

Queries registry keys for unique system GUIDs

Badlisted process makes network request

Enumerates connected drives

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.