MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080
SHA3-384 hash: 3eefffc560c54de173aaff7c7c6e014afef907fd95508ebd4f6348c1403c36f1312ba2aaece5941147df31d1b6a2c8e8
SHA1 hash: ee411d014f9f9d531d17e1937f1c41eac9d12b88
MD5 hash: a2e9b5a2001baa03a7dffba71ffdfff8
humanhash: eighteen-moon-don-florida
File name:file
Download: download sample
File size:122'368 bytes
First seen:2026-01-23 15:59:59 UTC
Last seen:2026-01-23 17:22:41 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 1536:lracUK3gqPilbVwkHURD8SbI9nk24C7OTEwufDFf1xJnywD5wyq545if5oms7y:HItbViFE9kDaOTGnyAwyqL
TLSH T145C3F147FEA0A122FD08A332CE16D77B6F34AC5C5F728252386D721C1EB659A51E79C0
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Bitsight
Tags:9c4517 dropped-by-amadey msi


Avatar
Bitsight
url: http://sharecodepro.com/uploads/e93d371c8a19cb07.msi

Intelligence

File Origin
# of uploads :
8
# of downloads :
70
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
MSI
an embedded setup program or component
Link:
https://research.acce.ciphertechsolutions.com/results/976ab724-9bd8-47a6-a574-ba7621e6eb30/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/49909/
Detection(s):
SecuriteInfo.com.VBS.DownLoader.4190.17113.25748.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69739b43f3cf908ba507bd39
Tags:
autorun shell virus sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm evasive fingerprint installer powershell zbot
Link:
https://www.filescan.io/uploads/69739b3eabc6d3ca6dec5325/reports/cf3dc89f-ea5a-46f4-99e1-23394ffcd2e4/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080
Verdict:
Malicious
File Type:
msi
First seen:
2026-01-20T01:01:00Z UTC
Last seen:
2026-01-24T07:41:00Z UTC
Hits:
~10
Detections:
Trojan-Downloader.PowerShell.Agent.sb HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic Trojan-Dropper.OLE2.Agent.sb
Link:
https://opentip.kaspersky.com/85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080/results?tab=lookup
Score:
39%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:MSZIP Office Document
Link:
https://app.malva.re/file/a2e9b5a2001baa03a7dffba71ffdfff8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080/
Verdict:
Malicious
Threat:
Trojan-Dropper.OLE2.Agent
Link:
https://tip.neiki.dev/file/85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080
Threat name:
Script-WScript.Infostealer.Zeus
Create hunting rule
Status:
Malicious
First seen:
2026-01-19 00:36:30 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qxgxuhre5rcjzg7v7bx7zt5c7ofgqtzeblqohnesqonue57fscaa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/260123-tf61zsgw7f/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Drops file in System32 directory
Enumerates connected drives
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
http://172.86.123.222/Petuhon.zip
http://172.86.123.222/Smokest120.zip
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 85cd7a1e24ec449c9bf5f86ffccfa2fb8a684f240ae0e3b492839b4277e59080

(this sample)

  
Dropped by
Amadey
  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3762662/
Cape
Cape
https://www.capesandbox.com/analysis/49909/

Comments