MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c17cd89df627bd2ed1962b7ca5012f70e47ddd3d129d17e4a3cc257a36a1b21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	8c17cd89df627bd2ed1962b7ca5012f70e47ddd3d129d17e4a3cc257a36a1b21
SHA3-384 hash:	514d0f9112bad6f046d9d0be40c1c3cb50329ed8fa43103232cab6e014c992543d64e5472c713f7102e4fcafff4a9e72
SHA1 hash:	6fcf58c4275a065ebe258b0246c6d7ca3ec987f2
MD5 hash:	bdb34cbe5285e80f16a50fd765308c5a
humanhash:	snake-hot-bacon-bacon
File name:	ConnectProAgentSetup.msi
Download:	download sample
File size:	23'444'992 bytes
First seen:	2026-08-08 14:10:58 UTC
Last seen:	2026-08-08 14:11:21 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	393216:KYxkueB0lUH4t78VeM495bmPjuU5GfeRBjdfaIUQCJvmS5vYX0S4j4gbxnfOyX/X:Ks9e2eHS6CbPLfeRXsuS5vYX84QOyvMs
TLSH	T124373322A88BCB30ED064876E46FBBFACFA25C1AC4D15167C614BD0E78B1145D3E25DB
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	BlinkzSec

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSI

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f4846d9c-fcf1-4214-8d31-754e4d719a5b/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/79228/

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8c17cd89df627bd2ed1962b7ca5012f70e47ddd3d129d17e4a3cc257a36a1b21

Verdict:

Unknown

File Type:

msi

Link:

https://opentip.kaspersky.com/8c17cd89df627bd2ed1962b7ca5012f70e47ddd3d129d17e4a3cc257a36a1b21/results?tab=lookup

Score:

36%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

defense_evasion discovery installer persistence privilege_escalation

Link:

https://tria.ge/reports/260808-rhhp3ayang/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Checks installed software on the system

Enumerates connected drives

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Modifies Windows Firewall

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8c17cd89df627bd2ed1962b7ca5012f70e47ddd3d129d17e4a3cc257a36a1b21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.