🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53612bc2ffd82e96a6493914035e6c00a44fe53e6a72e927f11947dcb36e1bb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53612bc2ffd82e96a6493914035e6c00a44fe53e6a72e927f11947dcb36e1bb8
SHA3-384 hash: 1aa88c4a928720ff12122061617d7b98968697ca95f0bc8b6f05ae74a85a28b4fcb65289add91ceadcf93bf4c930b368
SHA1 hash: f6bb9b36d0966699230f89bf23c04ad2cb8339a7
MD5 hash: dfc730be3bb1b15cbf0e31f70bf8f58c
humanhash: fillet-whiskey-undress-august
File name:53612bc2ffd82e96a6493914035e6c00a44fe53e6a72e927f11947dcb36e1bb8
Download: download sample
File size:8'085'504 bytes
First seen:2026-11-05 13:10:35 UTC
Last seen:2026-11-05 13:21:50 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:v70E/s7plwOHEa1sc4Lu4+krFTEKGgWmp7rcLj:v70E/cwwEa1sCNAFwKGg/6j
TLSH T14F8633A6C261D6AEC517007369ED9BDC72947D247A26252780C0F31C2F7AFB127EB538
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter ni_fi_701
Tags:msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
AT AT
Vendor Threat Intelligence
Malware configuration found for:
LNK MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/cf6705d2-94fc-4b70-938c-071c677145af/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97399/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aec807762f3df3e73e2ac04
Tags:
shellcode overt virus
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Searching for synchronization primitives
Creating a file in the Windows subdirectories
Creating a file
Running batch commands
Launching a process
Creating a process from a recently created file
Sending a custom TCP request
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
CAB cmd installer installer lolbin lolbin msbuild msbuild obfuscated
Link:
https://www.filescan.io/uploads/6aec8073c31b6da6fa1702c8/reports/ea49b56f-d9c1-4802-a6c9-9f023e001f68/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/53612bc2ffd82e96a6493914035e6c00a44fe53e6a72e927f11947dcb36e1bb8
Verdict:
Malicious
File Type:
msi
First seen:
2026-11-03T07:50:00Z UTC
Last seen:
2026-11-04T10:57:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/53612bc2ffd82e96a6493914035e6c00a44fe53e6a72e927f11947dcb36e1bb8/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1998984
Signature
Antivirus detection for dropped file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Sigma detected: Silenttrinity Stager Msbuild Activity
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1998984 Sample: jVvDv5FcQJ.msi Startdate: 05/11/2026 Architecture: WINDOWS Score: 100 47 mr-b01.tm-azurefd.net 2->47 49 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->49 55 Suricata IDS alerts for network traffic 2->55 57 Antivirus detection for dropped file 2->57 59 Multi AV Scanner detection for dropped file 2->59 61 4 other signatures 2->61 9 msiexec.exe 103 59 2->9         started        12 cmd.exe 1 2->12         started        14 msiexec.exe 3 2->14         started        signatures3 process4 file5 37 C:\Users\user\AppData\Local\...\MSBuild.exe, PE32 9->37 dropped 16 cmd.exe 2 9->16         started        18 MSBuild.exe 2 12->18         started        20 conhost.exe 12->20         started        22 chcp.com 1 12->22         started        process6 process7 24 cmd.exe 1 16->24         started        26 conhost.exe 16->26         started        process8 28 MSBuild.exe 15 307 24->28         started        33 conhost.exe 1 24->33         started        35 chcp.com 1 24->35         started        dnsIp9 51 1.0.0.1, 443, 49723 CLOUDFLARENET-CloudflareIncUS Australia 28->51 53 104.21.39.81, 443, 49724, 49725 CLOUDFLARENET-CloudflareIncUS Canada 28->53 39 C:\...\MSBuild.exe~RF1f3bdea0.TMP (copy), PE32 28->39 dropped 41 C:\...\MSBuild.exe~RF1f3bd411.TMP (copy), PE32 28->41 dropped 43 C:\Users\user\AppData\...\MSBuild.exe (copy), PE32 28->43 dropped 45 16 other malicious files 28->45 dropped 63 Sample is not signed and drops a device driver 28->63 65 Hides threads from debuggers 28->65 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->67 file10 signatures11
Verdict:
Malware
YARA:
4 match(es)
Tags:
.Net CAB:COMPRESSION:MSZIP Executable Execution: CMD in LNK LNK LOLBin LOLBin:%ComSpec% Malicious Managed .NET Office Document PDB Path PE (Portable Executable) PE File Layout SOS: 0.27 T1059.003 T1202: Indirect Command Execution T1204.002 T1218: System Binary Proxy Execution
Link:
https://app.malva.re/file/dfc730be3bb1b15cbf0e31f70bf8f58c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53612bc2ffd82e96a6493914035e6c00a44fe53e6a72e927f11947dcb36e1bb8/
Threat name:
Win32.Backdoor.Zapchast
Create hunting rule
Status:
Malicious
First seen:
2026-11-03 03:52:03 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=knqsxqx73axjnjsjhekagxtmacse7zj6njzosj7rdfd5zm3odo4a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261105-qe24vszzbx/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Malware Family:
n/a
Verdict:
Malicious
Tags:
evasion
YARA:
n/a
Link:
https://app.threat.zone/submission/ea0d0f2a-8ab0-43ea-b09d-8e08fc316691
Malware Family:
zapchast
Create hunting rule
Malicious:
True
Tags:
checks-usb-bus msi
Link:
https://intel.virussign.com/intelligence/file/53612bc2ffd82e96a6493914035e6c00a44fe53e6a72e927f11947dcb36e1bb8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53612bc2ffd82e96a6493914035e6c00a44fe53e6a72e927f11947dcb36e1bb8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/97399/

Comments