MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 561d10f11f9369d4763ffcbd350fecfcb87b1dbfba2b289cbb4cada87453aca9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GoToResolve

Vendor detections: 8

Intelligence 8 IOCs YARA 10 File information Comments

SHA256 hash:	561d10f11f9369d4763ffcbd350fecfcb87b1dbfba2b289cbb4cada87453aca9
SHA3-384 hash:	3d6226d65b3e1ec502a312effcefb0002214883f1b3ea253392d97af6a8b520788e6e5fb1659ba3668a5f307d31f9969
SHA1 hash:	a88211d3a85bcb1adff2f73820a68197e0b8ae2b
MD5 hash:	f696822f86ffd4a112c7d8c3f65e5941
humanhash:	nine-carpet-fillet-spaghetti
File name:	LogMeInResolve_Unattended.msi
Download:	download sample
Signature	GoToResolve Create hunting rule
File size:	37'085'184 bytes
First seen:	2026-05-17 01:20:49 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	786432:kfBBz66DIpCRkxjRlKjP1UrZ21G7KulNNm:kfBF66iGkxCtyZ2E7KN
TLSH	T176872217A2E61154D8BAD138CA6B9647FB723C06433066DF12A4B61A6F73BF01A7F314
TrID	93.8% (.MSI) Microsoft Windows Installer (454500/1/170) 4.0% (.WPS) Kingsoft WPS Office document (alt.) (19502/3/2) 1.6% (.) Generic OLE2 / Multistream Compound (8000/1) 0.5% (.ASSETS) Unity binary serialized Assets (generic) (2509/3/1)
Magika	msi
Reporter	Anonymous
Tags:	GoToResolve msi signed

Code Signing Certificate

Organisation:	GoTo Technologies USA, LLC
Issuer:	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:	sha384WithRSAEncryption
Valid from:	2025-08-21T00:00:00Z
Valid to:	2028-08-22T23:59:59Z
Serial number:	0ead3a3ffa70c0a20ae2368189935153
Intelligence:	41 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	e1ce3e36056006f8b8cdb33af5380a4f7a3058adbdb2bdd69648b07079dfb700
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSI

Details

MSI

an embedded setup program or component

Link:

https://research.acce.ciphertechsolutions.com/results/afa5dd10-6833-4e36-96e0-70aa5832adb8/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a091882953bbcef1c90d0f5

Tags:

n/a

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug CAB crypto fingerprint installer installer lolbin packed reconnaissance rundll32 signed wix

Link:

https://www.filescan.io/uploads/6a091815875badc3b3882213/reports/8371e151-e1c2-4f05-852d-42f3cabaefe4/overview

Verdict:

Suspicious

Labled as:

LogMeIn.E trojan

Link:

https://www.hybrid-analysis.com/sample/561d10f11f9369d4763ffcbd350fecfcb87b1dbfba2b289cbb4cada87453aca9

Verdict:

Clean

File Type:

Msi

First seen:

2026-05-16T22:31:00Z UTC

Last seen:

2026-05-18T23:03:00Z UTC

Hits:

~10

Detections:

not-a-virus:HEUR:RemoteAdmin.Win32.GoToResolve.gen

Link:

https://opentip.kaspersky.com/561d10f11f9369d4763ffcbd350fecfcb87b1dbfba2b289cbb4cada87453aca9/results?tab=lookup

Score:

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)