MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d95769a016b397333ba90fdc2f668f883c64774a2c0aaaf6b2d942bebaee9e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2d95769a016b397333ba90fdc2f668f883c64774a2c0aaaf6b2d942bebaee9e0
SHA3-384 hash:	e4d048e936f729c29db4a1e378b1dac3ea1daecf32a1c237091e957b1e389e7c349a48c870293a35a6bcf04fc1515417
SHA1 hash:	49308705e0bba1e0ba20b6dc354ff4e572382886
MD5 hash:	57c2738fc8468984445af041b0863d2c
humanhash:	lactose-equal-bakerloo-quebec
File name:	2d95769a016b397333ba90fdc2f668f883c64774a2c0aaaf6b2d942bebaee9e0
Download:	download sample
File size:	17'158'144 bytes
First seen:	2026-06-15 10:12:38 UTC
Last seen:	2026-06-15 10:12:43 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	393216:TulsZ3+cZJzyyRi12lBcP1wrHhw7niCj925HdK8:TulsEyzyyg7P6rW7f5sHd
TLSH	T1FB073327BC5A9708E9240275C99DF1A9C88A6C1A6D9F0123A7277758BD739F071F3CC2
TrID	86.8% (.MSI) Microsoft Windows Installer (454500/1/170) 11.6% (.MST) Windows SDK Setup Transform script (61000/1/5) 1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	JAMESWT_WT
Tags:	centrogauchodabahia123-com msi

JAMESWT_WT

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

55

Origin country :

IT

Vendor Threat Intelligence

ACCE MSI_FileType

Malware configuration found for:

AutoIt MSI

Details

Link:

https://research.acce.ciphertechsolutions.com/results/1e86014d-11c9-4bea-95cc-7fb1fd58f1c5/

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/70771/

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2fd05234eaf30d8ce64b08

Tags:

shellcode dropper virus

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

installer

Link:

https://www.filescan.io/uploads/6a2fd04a554e843ff86bdd69/reports/907f6936-f39d-45a0-b5c6-e8d6f5c27466/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/2d95769a016b397333ba90fdc2f668f883c64774a2c0aaaf6b2d942bebaee9e0

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

msi

First seen:

2025-10-29T15:08:00Z UTC

Last seen:

2025-10-31T17:09:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2d95769a016b397333ba90fdc2f668f883c64774a2c0aaaf6b2d942bebaee9e0/results?tab=lookup

Nucleon Malprob Susipicious

Score:

56%

Verdict:

Susipicious

File Type:

ARCHIVE

Link:

https://malprob.io/report/2d95769a016b397333ba90fdc2f668f883c64774a2c0aaaf6b2d942bebaee9e0

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2d95769a016b397333ba90fdc2f668f883c64774a2c0aaaf6b2d942bebaee9e0/

Neiki Trojan.Script

Verdict:

Malicious

Threat:

Trojan.Script

Link:

https://tip.neiki.dev/file/2d95769a016b397333ba90fdc2f668f883c64774a2c0aaaf6b2d942bebaee9e0

ReversingLabs TitaniumCloud Win32.Trojan.SorvePotel

Threat name:

Win32.Trojan.SorvePotel

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-29 21:00:17 UTC

File Type:

Binary (Archive)

Extracted files:

39

AV detection:

20 of 36 (55.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fwkxngqbnm4xgm52sd64f5ti7cb4mr3uulakvl3lfwkcx25o5hqa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260615-l9bsyacx6l/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Adds Run key to start application

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2d95769a016b397333ba90fdc2f668f883c64774a2c0aaaf6b2d942bebaee9e0

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/70771/