MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Seduploader

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5
SHA3-384 hash:	72ec599fd0729d012aef0fc799de4a37aba80b36174bd62ddc678bf528ae13738b768e9eabedc8f58ed1cdb518a963fa
SHA1 hash:	9c7705850f70aa3af850dba47ea5a78de3077f57
MD5 hash:	50b0b7d854f14594d419cce69a66b517
humanhash:	illinois-crazy-hamper-three
File name:	EasySuiteSetup.msi
Download:	download sample
Signature	Seduploader Create hunting rule
File size:	75'126'316 bytes
First seen:	2026-08-02 14:21:48 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:pSZm7O3jPaLd4bN4LZAw5GGxITqLAVrPtDJw+CTRbdO8iUBYNzSbBC4P0:A6Cj6d4bNIZAwcGxiqLMtDK+gdO8hBSb
TLSH	T1AFF7339BB4046C63C6DD043E953F6B3AF6610EF3760005626463BE9EDD7124A4B9D3AC
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	aachum
Tags:	dropped-by-SnappyClient mrarmksmsx-com msi not-Seduploader

iamaachum

https://mrarmksmsx.com/depend/EasySuiteSetup.msi

IOC: mrarmksmsx.com

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/62ba656f-77af-441d-b8ce-d6d11da37218/

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug crypto expired-cert fingerprint installer reconnaissance wix

Link:

https://www.filescan.io/uploads/6a6f52a7e293d5f89e85df36/reports/db93bf47-7b63-43a9-8d70-84d147b0c3f7/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5

Verdict:

Unknown

File Type:

msi

Link:

https://opentip.kaspersky.com/45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5/results?tab=lookup

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ixtr7nbot7cr6xmpn5vs2xnpetz3p47iquhg3yjdlxdyyygxvd2q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260802-rpt2nsbc79/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

Drops file in Windows directory

Adds Run key to start application

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.