MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87e4fd832dfaa1f31f6511a48fda3e89a7c74f84fe9aedf9b8800056c709f6bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 5 File information Comments

SHA256 hash:	87e4fd832dfaa1f31f6511a48fda3e89a7c74f84fe9aedf9b8800056c709f6bb
SHA3-384 hash:	4fcec13bbfc645f8fe0465746fe014302f3779a49c2f7881f0b8394589680d15c911f9e9998ee81467de0c287d689f35
SHA1 hash:	846310569c06a98758f9f2eacfc92082e331fcfa
MD5 hash:	6c250c075959e7da743b28bc714e2393
humanhash:	neptune-crazy-tennessee-victor
File name:	LocalOffice.zip
Download:	download sample
File size:	32'868'742 bytes
First seen:	2026-10-06 07:27:59 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	786432:FCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Ea1:UxbXnfCJMAYDi4D0C5Z9nT3D1
TLSH	T1B87733F1B043895A9DC19CE0E6C5C144E28A41E5CA743EB7D17A53F6C2E7AC7A4E73A0
Magika	zip
Reporter	smica83
Tags:	zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 7 file(s), sorted by their relevance:

File name:	UEMSAgent.msi
File size:	33'297'920 bytes
SHA256 hash:	92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
MD5 hash:	db7ca603d463a06806ff1660979f406d
MIME type:	application/x-msi

File name:	setup.bat
File size:	3'047 bytes
SHA256 hash:	91f784bf3dd83c0f5135ac1fd00a0fdd430720ebc57ec4c2eccb7875dbc8a90d
MD5 hash:	9cb71612a1aa60c6a9c893bcefced81f
MIME type:	text/x-msdos-batch

File name:	DMRootCA-Server.crt
File size:	1'356 bytes
SHA256 hash:	58cd87410014823bf8dae7d696936a2f0d71c32e94b2047ba078cbb025ce9e86
MD5 hash:	d4f3ff2960c82a07e61d01e630aa55e2
MIME type:	text/plain

File name:	README.html
File size:	1'332 bytes
SHA256 hash:	02595856ad354a47e9c664a55dc428aad19ce73a00fe95228bbe590cfca944d8
MD5 hash:	2d939d7afe37b02f77e4eb4d5e5916fc
MIME type:	text/html

File name:	UEMSAgent.mst
File size:	20'480 bytes
SHA256 hash:	180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
MD5 hash:	0509fd12bad30c0cbe679a18bcb2042a
MIME type:	application/vnd.ms-msi

File name:	DCAgentServerInfo.json
File size:	1'672 bytes
SHA256 hash:	168c0de142f28eb3f4b7969a86d0f832133f2e70f5880d7f29dc9320c9b6ddb5
MD5 hash:	13e1ab57d8aaf259e8875aba94492fec
MIME type:	application/json

File name:	DMRootCA.crt
File size:	1'522 bytes
SHA256 hash:	0237f47c75cc623a7abf5df6be206118162599f371a95e8a89b21fa3f33e8fe9
MD5 hash:	f49a63757277f2983662c6176ad0dd86
MIME type:	text/plain

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/1b36286d-ff7f-481c-ac18-689082682f76/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac3c74720ba0e2385cd4b39

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/87e4fd832dfaa1f31f6511a48fda3e89a7c74f84fe9aedf9b8800056c709f6bb

Verdict:

Unknown

File Type:

zip

First seen:

2026-10-05T01:58:00Z UTC

Last seen:

2026-10-06T14:03:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/87e4fd832dfaa1f31f6511a48fda3e89a7c74f84fe9aedf9b8800056c709f6bb/results?tab=lookup

Score:

26%

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/261006-knd6havx4q/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

System Time Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/87e4fd832dfaa1f31f6511a48fda3e89a7c74f84fe9aedf9b8800056c709f6bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	Hunt_ManageEngine_UEMS_Agent_Bundle Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects archives, installers, or files containing ManageEngine UEMS Agent and Remote Control bundled components

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/