MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35d09719b7c7db250495b84eda81e59862199019b3012d5ec3ea3d60144215b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	35d09719b7c7db250495b84eda81e59862199019b3012d5ec3ea3d60144215b5
SHA3-384 hash:	896ae8d907035beca66a4c44e2653883012e82becc16cec1dc100214e66644235f3eb85f05accc5fe8812a5140da8fab
SHA1 hash:	eb70aa3cfab12c6e4e0ac4548892e6d34522745e
MD5 hash:	e63458f5ac83360f9ed6cbbe00957591
humanhash:	uncle-failed-diet-mango
File name:	CrimsonMods.msi
Download:	download sample
File size:	19'836'928 bytes
First seen:	2026-09-23 23:13:47 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	393216:6gH/h1nwkf5HIJEYBgL84H8fCwT+XFzdvh+3s3C+r+ZKM4EciuGv:JfwGoJEYGH8fCweLp+8y+KiEc
TLSH	T18C1733B668225D63CA61317B63534765AF300EB17B118B092E70F85D1DFE0FA6B4938B
TrID	53.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 39.2% (.MSP) Windows Installer Patch (44509/10/5) 7.0% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	AmadeyHunter
Tags:	msi signed

Code Signing Certificate

Organisation:	CedarWood Theme Switch
Issuer:	CedarWood Theme Switch
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-09-23T05:08:44Z
Valid to:	2027-09-23T05:18:44Z
Serial number:	798c8d7b091d3dbe431de35c0387c762
Thumbprint Algorithm:	SHA256
Thumbprint:	2f7c0da566f63f4369e15041c170e4994deffc70673c7aa30461b5bff66606cd
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

AmadeyHunter

Can be found hosted at https://www.mediafire.com/file_premium/krd5eej1cse8u89/CrimsonMods.zip/file
Can be found by browsing the referenced links above...
Notice: If it's been awhile, by now the domains might be known as malicious or taken down/offline, this excludes mediafire.com...

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d8a5783f-167f-49af-938c-030f0a943591/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/88748/

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug CAB expired-cert installer installer reconnaissance signed

Link:

https://www.filescan.io/uploads/6ab45d4966e0fc549ccdef35/reports/a0d50ef0-3295-401d-89d4-e1de9999bd5d/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/35d09719b7c7db250495b84eda81e59862199019b3012d5ec3ea3d60144215b5

Verdict:

Unknown

File Type:

msi

Link:

https://opentip.kaspersky.com/35d09719b7c7db250495b84eda81e59862199019b3012d5ec3ea3d60144215b5/results?tab=lookup

Score:

84%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260923-273rmswx7l/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Badlisted process makes network request

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/35d09719b7c7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/35d09719b7c7db250495b84eda81e59862199019b3012d5ec3ea3d60144215b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_SliverFox_String Create hunting rule
Author:	huoji
Description:	Detect files is `SliverFox` malware

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/