MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41
SHA3-384 hash: 9bee570851c70bed2c576be8bc144b6601a5075c9dbdd45143dedb6cb06d53a382511a0968f3137da55598208a304ecb
SHA1 hash: dc032f1b6fbef21ab7a9b2c21749b96122c67a9d
MD5 hash: cbed8e21dc0c07068f86b1ba05e06d06
humanhash: whiskey-foxtrot-vermont-timing
File name:file
Download: download sample
File size:9'936'896 bytes
First seen:2026-02-21 16:36:42 UTC
Last seen:2026-02-24 19:29:19 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:A3DmbAYSBXzkn/9obSXYOBdOT9kEPaXHenuBWppNur+:A3yUbBXzC6nOBdOTPSKpc+
TLSH T108A63378EAE22AD2E947D17D83378B55CA7C4C0C9947001A26F6B0497DBF9263CF4B19
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Bitsight
Tags:dropped-by-amadey fbf543 msi


Avatar
Bitsight
url: http://130.12.180.43/files/8285062997/xv3EWMD.msi

Intelligence

File Origin
# of uploads :
28
# of downloads :
124
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ab40c7a9-b109-4737-9721-5d958f8c52bc/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53971/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6999df408fffa866e3b03261
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
installer installer wix
Link:
https://www.filescan.io/uploads/6999df3897feb4afd650c999/reports/e038549f-6af3-43d0-a350-d1f77fc6da9f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41
Result
Verdict:
SUSPICIOUS
Link:
https://labs.inquest.net/dfi/sha256/5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Clean
File Type:
msi
Link:
https://opentip.kaspersky.com/5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41/results?tab=lookup
Score:
9%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:LZX Executable Office Document PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump)
Link:
https://app.malva.re/file/cbed8e21dc0c07068f86b1ba05e06d06
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l4lluyotqs7iqhkatws6movdktainhb7ch274e4gw2v3qhgeljaq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion execution persistence privilege_escalation ransomware spyware stealer
Link:
https://tria.ge/reports/260221-t4x3zsez2f/
Behaviour
Checks SCSI registry key(s)
Kills process with taskkill
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 5f16ba61d384be881d409da5e63aa354c0869c3f11f5fe1386b6abb81cc45a41

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3782426/
Cape
Cape
https://www.capesandbox.com/analysis/53971/

Comments