MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3598ce0c91a71cf6634f476d89ce173bfc8ccfe050cdc7cc8760490797b80c68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3598ce0c91a71cf6634f476d89ce173bfc8ccfe050cdc7cc8760490797b80c68
SHA3-384 hash:	0df2ff3d0d3c5d192101f3be084aca455301d83555f010a0790c5a34371264030ad3dfa7d1c4a8b6297d6f2f5dbfcff9
SHA1 hash:	28bdb35a3199487436ab64c4ef397680b0c433e9
MD5 hash:	d93044c5d08d918938d1f1775c0dfb2e
humanhash:	princess-july-sixteen-twelve
File name:	sysdiag-all-x64.msi
Download:	download sample
Signature	Gh0stRAT Alert Create hunting rule
File size:	88'642'560 bytes
First seen:	2026-07-23 12:07:56 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:bM7b+Dlpi5fXcujhOPzJeJKlnpPwrtF2SEk4hVURAAKT3cgyEqx:bM7cU+ujhGUoPwRhE4+cgyd
TLSH	T196183376BA4908BAD16B7C3C0AB11E0EC6B13C4457D545D777227C3B0967BA0CAB93B2
TrID	89.6% (.MSI) Microsoft Windows Installer (454500/1/170) 8.7% (.MSP) Windows Installer Patch (44509/10/5) 1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	smica83
Tags:	Gh0stRAT msi

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

108

Origin country :

HU

Vendor Threat Intelligence

ACCE MSI_FileType

Details

Link:

https://research.acce.ciphertechsolutions.com/results/bc02c9d9-9858-45e1-a40b-637730fb608e/

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm fingerprint fingerprint overlay packed reconnaissance wix

Link:

https://www.filescan.io/uploads/6a620443c4e962ec55592629/reports/a712b6e3-7517-4ea8-b98e-43c84289928e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3598ce0c91a71cf6634f476d89ce173bfc8ccfe050cdc7cc8760490797b80c68

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

msi

First seen:

2026-07-22T05:08:00Z UTC

Last seen:

2026-07-22T22:28:00Z UTC

Hits:

~10

Detections:

Backdoor.Farfli.TCP.C&C PDM:Trojan.Win32.Generic VHO:Trojan-Dropper.Win32.Silverfox.gen Trojan.Win64.Agent.sba Trojan.Win32.Waldek.cnin Trojan-Dropper.Win32.Silverfox.sb Trojan.Win32.Waldek.sb Trojan.Win32.Agent.sb Trojan-Dropper.Win32.Silverfox.aso Backdoor.Win32.Zegost.sb

Link:

https://opentip.kaspersky.com/3598ce0c91a71cf6634f476d89ce173bfc8ccfe050cdc7cc8760490797b80c68/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1947053

Signature

Drops executables to the windows directory (C:\Windows) and starts them

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Suricata IDS alerts for network traffic

Tries to detect sandboxes / dynamic malware analysis system (Installed program check)

Unusual module load detection (module proxying)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/3598ce0c91a71cf6634f476d89ce173bfc8ccfe050cdc7cc8760490797b80c68

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Packed.Generic

Threat name:

Win64.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-23 09:24:44 UTC

File Type:

Binary (Archive)

Extracted files:

582

AV detection:

13 of 38 (34.21%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gwmm4deru4opmy2pi5wyttqxhp6izt7akdg4ptehmbeqpf5ybrua._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery installer persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260723-pa7m4swshz/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Inno Setup is an open-source installation builder for Windows applications.

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Checks installed software on the system

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.