MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 821bbbfb7c8f4b3eaae16abd0dd1a868c7d39225f56b62013b1a563316460349. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	821bbbfb7c8f4b3eaae16abd0dd1a868c7d39225f56b62013b1a563316460349
SHA3-384 hash:	6e8298c647219cdbe8415b3509e1d63fd207320aabb5681002d93f4762402a7f666520748f2ceb9d08f897837dd4f8fa
SHA1 hash:	aa284e1192bdfb69fa0e96b4bb698151b19a0f15
MD5 hash:	6900e58c5d4b4fd1846f75cae53dcaff
humanhash:	hotel-magnesium-hot-hot
File name:	SecuriteInfo.com.Trojan.MulDrop32.16151.6465.21960
Download:	download sample
File size:	98'562'048 bytes
First seen:	2025-08-08 08:54:10 UTC
Last seen:	2025-08-28 14:38:22 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:i7OD2PkF81cCD6nyTWeDzvIkfArQC2LU9Oc8MJWVh7FlnAiEC27YpwF:i73cFgjiySeDzvJfIQDUU7MJWwXH0pO
TLSH	T1E628331578B896E3D9F308358D6BC72A9268BE675A6048E79FF03B9C04302D37277197
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	SecuriteInfoCom
Tags:	msi signed

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

44

Origin country :

FR

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6895bb651e8a59ee04e74968

Tags:

n/a

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-debug crypto expired-cert fingerprint installer signed

Link:

https://www.filescan.io/uploads/6895bba133ecf0a15b75acaf/reports/c6a03e27-64b7-42b0-8d4e-a3189ff25330/overview

Hybrid Analysis Malware.U.DeerStealer

Verdict:

Malicious

Labled as:

Malware.U.DeerStealer

Link:

https://www.hybrid-analysis.com/sample/821bbbfb7c8f4b3eaae16abd0dd1a868c7d39225f56b62013b1a563316460349

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/821bbbfb7c8f4b3eaae16abd0dd1a868c7d39225f56b62013b1a563316460349

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1750132

Signature

Changes security center settings (notifications, updates, antivirus, firewall)

Leaks process information

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to delay execution (extensive OutputDebugStringW loop)

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/821bbbfb7c8f4b3eaae16abd0dd1a868c7d39225f56b62013b1a563316460349

CERT.PL MWDB

Gathering data

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/821bbbfb7c8f4b3eaae16abd0dd1a868c7d39225f56b62013b1a563316460349

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qin3x634r5ft5kxbnk6q3unindd5herf6vvweaj3djldgfsganeq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/250808-kvd43sdp4y/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Blocklisted process makes network request

Enumerates connected drives

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/65a4545b-75c6-482f-a24f-416919e526c9

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.