MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a1c9f0f30abded1a5ee6b53f0551a7cf7599adf34f1cb6f0d5d62dc5d81a8dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6a1c9f0f30abded1a5ee6b53f0551a7cf7599adf34f1cb6f0d5d62dc5d81a8dc
SHA3-384 hash:	ebe2c99f3a39da389754bcbba686fff663e3ea5cb02be685a2c80a0edc8ebc181e2e1c271503695cfa3ebe0169e71ce1
SHA1 hash:	7f89e3c7aecba8e10be58394c6584d52561486a8
MD5 hash:	0b5c8f608368a888a5751858bbf361a0
humanhash:	king-pizza-mike-fish
File name:	SecretCryptos-26.2.1.msi
Download:	download sample
File size:	87'334'912 bytes
First seen:	2025-12-05 02:17:00 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:1QxWkwW+Qqu3dEVtImgJYnCyTonffkgihojaFojZi9nH7JfORThDpB:WWk8u3drtUKjWH9nH7RORtlB
TLSH	T183183323198E9C4BF50A1438402E993FE66FE9B5A92130BF667D3C281773775B608E1D
TrID	86.8% (.MSI) Microsoft Windows Installer (454500/1/170) 11.6% (.MST) Windows SDK Setup Transform script (61000/1/5) 1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	ninjacatcher
Tags:	msi trojan

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

US

Vendor Threat Intelligence

ACCE 3CX_MSI MSI_FileType

Details

Link:

https://research.acce.ciphertechsolutions.com/results/eb1dce79-dc8b-45bf-9f46-7a3d5f2ddfeb/

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=693240c721e2f720d66c1e71

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug crypto fingerprint installer installer wix

Link:

https://www.filescan.io/uploads/693240bdbc15eab491f4e50e/reports/59216b51-e77f-4729-851a-83ff5c373689/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6a1c9f0f30abded1a5ee6b53f0551a7cf7599adf34f1cb6f0d5d62dc5d81a8dc

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

msi

Link:

https://opentip.kaspersky.com/6a1c9f0f30abded1a5ee6b53f0551a7cf7599adf34f1cb6f0d5d62dc5d81a8dc/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/6a1c9f0f30abded1a5ee6b53f0551a7cf7599adf34f1cb6f0d5d62dc5d81a8dc

CERT.PL MWDB

Gathering data

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/6a1c9f0f30abded1a5ee6b53f0551a7cf7599adf34f1cb6f0d5d62dc5d81a8dc

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nioj6dzqvppndjponnj7avi2pt3vtgw7gty4w3ynlvrnyxmbvdoa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/251205-cqzwzshl5v/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

Drops file in Windows directory

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/6ee6fb54-78bc-46e8-b13a-eedab33eefce

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.