MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e
SHA3-384 hash: 875db73a35731dd89ae13154d6d8f7c6f9a7a86e861c5f4f57bafeae05850b5bc21a434390ad1e35412ce7ed08dee233
SHA1 hash: 244c7008be6f767f0f31a341fe0e70fa2e9a5399
MD5 hash: 2db9ee63581f0297d8ca118850685602
humanhash: glucose-pasta-black-double
File name:2db9ee63581f0297d8ca118850685602.msi
Download: download sample
File size:2'159'104 bytes
First seen:2022-01-16 18:49:33 UTC
Last seen:2022-01-16 20:50:11 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:1+J3ZO5YTq2TvT7qEV3VwIDDurDx2iFVNajAYYnkpxOhGkmVgU6oiL:YaY+2TvaEVW1xyAYYnkPOY
Threatray 109 similar samples on MalwareBazaar
TLSH T186A58C20F696C036D0BE41711E6DDB5F91397E720B7284EB77D82AAE09B29C11731F26
Reporter abuse_ch
Tags:msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
346
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/219637/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.47903789.17062.19517.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
80%
Tags:
anti-debug cmd.exe control.exe ftp.exe hacktool msiexec.exe packed packed print.exe remote.exe shell32.dll update.exe wscript.exe
Link:
https://www.filescan.io/uploads/61e468e2e997359713f9e106/reports/63ed7ca1-0126-48de-acd1-6d2e030dc9b1/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e
Details
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/921439
Signature
Adds a directory exclusion to Windows Defender
Creates an autostart registry key pointing to binary in C:\Windows
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 553916 Sample: Bn3pZ7FTQw.msi Startdate: 16/01/2022 Architecture: WINDOWS Score: 48 90 Multi AV Scanner detection for submitted file 2->90 92 Sigma detected: Powershell Defender Exclusion 2->92 94 Adds a directory exclusion to Windows Defender 2->94 96 Sigma detected: Suspicious Script Execution From Temp Folder 2->96 9 msiexec.exe 85 41 2->9         started        12 cmd.exe 1 2->12         started        14 msiexec.exe 4 2->14         started        process3 file4 72 C:\Windows\Installer\MSIE6E2.tmp, PE32 9->72 dropped 74 C:\Windows\Installer\MSIE038.tmp, PE32 9->74 dropped 76 C:\Windows\Installer\MSIDF0E.tmp, PE32 9->76 dropped 78 3 other files (none is malicious) 9->78 dropped 16 aipackagechainer.exe 2 3 9->16         started        20 msiexec.exe 39 9->20         started        22 cmd.exe 1 1 12->22         started        24 conhost.exe 1 12->24         started        26 clip.exe 1 12->26         started        process5 file6 62 C:\Users\user\AppData\Local\...\AI_AC8C.ps1, ASCII 16->62 dropped 88 Creates an autostart registry key pointing to binary in C:\Windows 16->88 28 PS4SAVEWIZARD.exe 9 4 16->28         started        31 powershell.exe 16->31         started        64 C:\Users\user\...\aipackagechainer.exe, PE32 20->64 dropped 66 C:\Users\user\AppData\...\PS4SAVEWIZARD.exe, PE32+ 20->66 dropped 68 C:\Users\user\AppData\...\file_deleter.ps1, ASCII 20->68 dropped 70 2 other files (1 malicious) 20->70 dropped signatures7 process8 signatures9 98 Adds a directory exclusion to Windows Defender 28->98 33 cmd.exe 1 28->33         started        35 cmd.exe 1 28->35         started        37 cmd.exe 1 28->37         started        41 2 other processes 28->41 39 conhost.exe 31->39         started        process10 process11 43 curl.exe 1 33->43         started        46 conhost.exe 33->46         started        48 clip.exe 1 33->48         started        50 curl.exe 1 35->50         started        56 2 other processes 35->56 52 curl.exe 1 37->52         started        58 2 other processes 37->58 54 curl.exe 41->54         started        60 3 other processes 41->60 dnsIp12 80 cdn.discordapp.com 162.159.135.233, 443, 49770 CLOUDFLARENETUS United States 43->80 82 162.159.130.233, 443, 49771 CLOUDFLARENETUS United States 50->82 84 sincheats.com 217.21.76.148, 443, 49773, 49777 IPPLANET-ASIL United Kingdom 52->84 86 192.168.2.1 unknown unknown 54->86
Gathering data
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-12-22 22:02:26 UTC
File Type:
Binary (Archive)
Extracted files:
89
AV detection:
6 of 43 (13.95%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
7a786d6cfe052c82e7ab1d5b7f4427c594f2497c4fb374ab852e01c2c1a2b548
9405f9084c8ec3eff442b83c20928fceb3e6372d504381b0527a7512a9889231
e6d90883fd0e3c7576c140d6f12e04e1e54c3789ec4b2bdea925c9bdb6aa1f43
e6dff8475541ebddc1f0db47a311eb2c25581b7d5e62af8066d59c283114c2d3
f30dab44e1b3c177c002b35c5e9a933b79345c378dbf434b96de62051bbb1eb0
ffc3d4c2d7568d3d632ba01f05fcb54bb8bc2b73afabc4741999957498011568
+ 99 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220116-xgy9bagbhq/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Enumerates connected drives
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.28
Link:
https://yomi.yoroi.company/submissions/8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR
Rule name:SUSP_Encoded_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1978545/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/219637/

Comments