🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d
SHA3-384 hash: fb6c89acf88e0fd66ff26e3a6f5459a681c7757120be6a56b23b15cca8aa9e3cd3c5ec850381d5deca3e1410b06c6dac
SHA1 hash: 8d04816062e88d0446b9f2fee7f4e90453d6e3d3
MD5 hash: 425a1389f41b65ad040f5e818ecc3fba
humanhash: missouri-jig-oxygen-moon
File name:AdvancedIPScanner.msi
Download: download sample
File size:60'321'792 bytes
First seen:2026-10-27 22:18:07 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 1572864:cmUCCbSahYDLwDI5NZXQH/ddjZm/4uROPyTnNAK6KsddzC+WRLd7r:axWa+BZa1JF7KTNNnsddzC+WRLdP
TLSH T151D733B7D04E433AF92BF93581F82A1E91413C52770394BAF1527AA397B73D79A38046
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter SquiblydooBlog
Tags:msi signed

Code Signing Certificate

Organisation:Lille Lykke Gave og Interiør ANS
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2026-10-17T00:00:00Z
Valid to:2027-10-17T23:59:59Z
Serial number: b683afc8350ca6388ffb39194e094b09
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: b0d950b696ed1c560ac32fe52ba6ca5f162e4b08e8e166b612d011f08b7c4128
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/fdbe39b3-c489-472a-972e-d3e2913e03de/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae1233d49621540087bf7ab
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug crypto crypto fingerprint installer reconnaissance signed
Link:
https://www.filescan.io/uploads/6ae1232f70bca7b36c62083a/reports/a97d3709-1d57-4374-bd92-45719f650738/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d
Verdict:
Adware
File Type:
msi
First seen:
2026-10-27T11:00:00Z UTC
Last seen:
2026-10-29T07:42:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.evad
Score:
28 / 100
Link:
https://www.joesandbox.com/analysis/1993451
Signature
Executes downloaded native code through thread-pool callbacks
Queries DNS domain through GetComputerNameExW (potential sandbox evasion)
Unusual module load detection (module proxying)
Yara detected Advanced IP Scanner Hacktool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1993451 Sample: AdvancedIPScanner.msi Startdate: 28/10/2026 Architecture: WINDOWS Score: 28 47 www.advanced-ip-scanner.com 2->47 49 machinegirl.carvelpolman.workers.dev 2->49 51 3 other IPs or domains 2->51 61 Yara detected Advanced IP Scanner Hacktool 2->61 63 Executes downloaded native code through thread-pool callbacks 2->63 9 msiexec.exe 279 218 2->9         started        12 msiexec.exe 3 2->12         started        signatures3 process4 file5 33 C:\ProgramData33odeJS\node.exe, PE32+ 9->33 dropped 35 C:\Windows\Installer\MSID21D.tmp, PE32 9->35 dropped 37 C:\Windows\Installer\MSID027.tmp, PE32 9->37 dropped 39 59 other files (none is malicious) 9->39 dropped 14 node.exe 8 12 9->14         started        18 Advanced_IP_Scanner_2.5.4594.1.exe 2 9->18         started        21 msiexec.exe 2 9->21         started        23 msiexec.exe 9->23         started        process6 dnsIp7 55 cedar-stone.normanitavo.workers.dev 104.21.81.170, 443, 49715 CLOUDFLARENET-CloudflareIncUS Canada 14->55 57 bluepeak.normanitavo.workers.dev 172.67.162.181, 443, 49714 CLOUDFLARENET-CloudflareIncUS Canada 14->57 59 machinegirl.carvelpolman.workers.dev 172.67.178.42, 443, 49713 CLOUDFLARENET-CloudflareIncUS Canada 14->59 65 Queries DNS domain through GetComputerNameExW (potential sandbox evasion) 14->65 67 Unusual module load detection (module proxying) 14->67 31 C:\...\Advanced_IP_Scanner_2.5.4594.1.tmp, PE32 18->31 dropped 25 Advanced_IP_Scanner_2.5.4594.1.tmp 5 13 18->25         started        file8 signatures9 process10 file11 41 C:\Users\user\...\aips_is_install_dll.dll, PE32 25->41 dropped 43 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 25->43 dropped 45 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 25->45 dropped 28 advanced_ip_scanner.exe 60 25->28         started        process12 dnsIp13 53 advanced-ip-scanner.com 188.40.30.100, 49717, 49718, 49719 HETZNER-ASDE Germany 28->53
Score:
8%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ngf2e7sh3oj37higetscwzadpxiltyu5lia6kawwve664p4wznoq._file
Verdict:
malicious
Label(s):
ADMINTOOL_Radmin
Create hunting rule
Link:
https://reports.threatray.com/3459c98d-ba05-48f3-91aa-ffa9137cbba1
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery installer persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261027-174hhag14j/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Inno Setup is an open-source installation builder for Windows applications.
Event Triggered Execution: Installer Packages
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Badlisted process makes network request
Enumerates connected drives
Malware family:
CobaltStrike
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/698ba27e47db/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments