🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f7ca145520351f85350d8a68b9188825cf0f9ef3868bbf32ec7fe703ca049ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f7ca145520351f85350d8a68b9188825cf0f9ef3868bbf32ec7fe703ca049ec
SHA3-384 hash: f1dea578bd6c3a701cacb5ec241c2e6d234a6c9c3b1876cdd007d1615feb948b4525b332479a0ddfc4a938ee7b61dde7
SHA1 hash: 565ae581c7f208074d0d4f2b95db218a8c6c7edb
MD5 hash: 63c26f83ee36715685c0dcaf57794283
humanhash: enemy-july-ohio-hot
File name:5f7ca145520351f8.bin
Download: download sample
File size:131'072 bytes
First seen:2026-10-23 02:24:08 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 384:W173OItkVj20u8aVuIfilQJTtWl38vN3IdXgtz5JK0truVvpJerV0RzdBJW7xkK3:wPtAi0d5pr3i36qmC
TLSH T1F6D34F2344F6C681EBACC2F0897DDAA4176A0EDC453D1A793388B1E42D371BD719626F
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Tuxxin
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/01180400-0765-45dd-abfa-aacbd5aad5d6/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/94203/
Detection(s):
MiscreantPunch.EvilMacro.PSHELLCHR.170728.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VBS.Obfus-248.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6adac55bafb06e650cd8ca52
Tags:
n/a
Verdict:
Suspicious
Labled as:
TR/Malware
Link:
https://www.hybrid-analysis.com/sample/5f7ca145520351f85350d8a68b9188825cf0f9ef3868bbf32ec7fe703ca049ec
Verdict:
Clean
File Type:
msi
First seen:
2026-10-16T16:52:00Z UTC
Last seen:
2026-10-24T19:34:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/5f7ca145520351f85350d8a68b9188825cf0f9ef3868bbf32ec7fe703ca049ec/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1990820
Signature
AI detected malicious Powershell script
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Powershell connects to network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1990820 Sample: 5f7ca145520351f8.bin.msi Startdate: 23/10/2026 Architecture: WINDOWS Score: 92 31 sebora.cfd 2->31 37 Malicious sample detected (through community Yara rule) 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 AI detected malicious Powershell script 2->41 43 3 other signatures 2->43 9 msiexec.exe 75 36 2->9         started        11 msiexec.exe 2 2->11         started        signatures3 process4 signatures5 14 msiexec.exe 1 2 9->14         started        45 Uses ping.exe to sleep 11->45 47 Bypasses PowerShell execution policy 11->47 49 Uses ping.exe to check the status of other devices and networks 11->49 process6 signatures7 51 Uses ping.exe to sleep 14->51 17 powershell.exe 14 15 14->17         started        21 PING.EXE 1 14->21         started        process8 dnsIp9 27 sebora.cfd 172.67.202.124, 443, 49720 CLOUDFLARENET-CloudflareIncUS Canada 17->27 33 Found suspicious powershell code related to unpacking or dynamic code loading 17->33 35 Powershell connects to network 17->35 23 conhost.exe 17->23         started        29 127.0.0.1 unknown unknown 21->29 25 conhost.exe 21->25         started        signatures10 process11
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/5f7ca145520351f85350d8a68b9188825cf0f9ef3868bbf32ec7fe703ca049ec
Verdict:
Malware
YARA:
5 match(es)
Tags:
ADODB.Stream CAB:COMPRESSION:LZX COM Behavior Trace DeObfuscated Obfuscated Office Document PowerShell Scripting.FileSystemObject SOS: 0.32 SOS: 0.53 T1027 T1059.001 T1059.005 VBS Execute Sub-Script VBScript WScript.Shell
Link:
https://app.malva.re/file/63c26f83ee36715685c0dcaf57794283
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f7ca145520351f85350d8a68b9188825cf0f9ef3868bbf32ec7fe703ca049ec/
Threat name:
Script-WScript.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-16 21:39:38 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
13 of 36 (36.11%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l56kcrksani7qu2q3ctixemiqjopb6pphbulx4zoy77hapfajhwa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261023-cvxbnabw2q/
Behaviour
Checks SCSI registry key(s)
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Command and Scripting Interpreter: PowerShell
Event Triggered Execution: Installer Packages
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Windows directory
Enumerates connected drives
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f7ca145520351f85350d8a68b9188825cf0f9ef3868bbf32ec7fe703ca049ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 5f7ca145520351f85350d8a68b9188825cf0f9ef3868bbf32ec7fe703ca049ec

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3951155/
Cape
Cape
https://www.capesandbox.com/analysis/94203/

Comments