🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983
SHA3-384 hash: 9534da5dc63d3abab20ec61d77084bc11e871a55707dc32ae0296874d4f60638850043df796fd33fc345ceba89bfbcad
SHA1 hash: bfecb8ce89a312d2ef4afc64a63847ae11c6f69e
MD5 hash: 0eeb1c0133eb4d571178b2d9d14ce3e9
humanhash: pluto-bacon-oven-delta
File name:3CXDesktopApp-18.12.416.msi
Download: download sample
File size:102'555'648 bytes
First seen:2024-06-17 05:16:27 UTC
Last seen:2025-07-04 04:00:21 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 3145728:Ujlq80AfkRGgGGo4yrtD1PQLzth2TBcMa8uGj2A:8lqmijypD1YPthSkS
TLSH T156283383E483A373DEF7DA73A506460A97643D255E354843A372B214A9732413FFA72B
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter Anonymous
Tags:msi signed

Code Signing Certificate

Organisation:3CX Ltd
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2020-11-02T00:00:00Z
Valid to:2023-11-02T23:59:59Z
Serial number: 1b6611df9c9a4d6ecc8ed50c9b917873
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 176e31b4ea8a18b16c768fa1364b0a7b77e5e87fbdfd04cc32b93c4aa1788ac9
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
5
# of downloads :
108
Origin country :
CH CH
Vendor Threat Intelligence
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=666fdf2a89a0563951f96c3fwin7simulatehigh_evasion
Tags:
n/a
Verdict:
Malicious
Labled as:
Win64/NukeSped.OY trojan
Link:
https://www.hybrid-analysis.com/sample/59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983
Result
Threat name:
n/a
Detection:
suspicious
Classification:
troj
Score:
32 / 100
Link:
https://www.joesandbox.com/analysis/1204823
Signature
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 837739 Sample: 3CXDesktopApp-18.12.416.msi Startdate: 30/03/2023 Architecture: WINDOWS Score: 32 63 Yara detected Generic Downloader 2->63 10 msiexec.exe 217 147 2->10         started        13 3CXDesktopApp.exe 2->13         started        15 3CXDesktopApp.exe 2->15         started        17 msiexec.exe 14 2->17         started        process3 file4 51 C:\Users\user\AppData\Local\...\Update.exe, PE32 10->51 dropped 53 C:\Windows\Installer\MSIFDDB.tmp, PE32+ 10->53 dropped 55 C:\Windows\Installer\MSIF57D.tmp, PE32 10->55 dropped 57 17 other files (none is malicious) 10->57 dropped 19 msiexec.exe 1 10->19         started        21 msiexec.exe 10->21         started        23 3CXDesktopApp.exe 7 13->23         started        25 3CXDesktopApp.exe 6 15->25         started        process5 process6 27 3CXDesktopApp.exe 19->27         started        29 3CXDesktopApp.exe 23->29         started        31 3CXDesktopApp.exe 23->31         started        33 3CXDesktopApp.exe 25->33         started        35 3CXDesktopApp.exe 25->35         started        process7 37 3CXDesktopApp.exe 12 69 27->37         started        dnsIp8 59 192.168.2.1 unknown unknown 37->59 40 3CXDesktopApp.exe 37->40         started        43 reg.exe 37->43         started        45 3CXDesktopApp.exe 37->45         started        47 4 other processes 37->47 process9 dnsIp10 61 dns.google 8.8.4.4, 443, 49706 GOOGLEUS United States 40->61 49 conhost.exe 43->49         started        process11
Score:
48%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983
Gathering data
Threat name:
Archive.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-03-22 09:04:54 UTC
File Type:
Binary (Archive)
Extracted files:
3360
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lhq635gyf6xes6hjoujlamy3p2zb3vfyhc4fbosgpfgzy6rmbgbq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/240617-fyr3wszfmj/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Blocklisted process makes network request
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments