MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HijackLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf
SHA3-384 hash: 508fccb57ee7b1020c24897b0a32bfa7b05dc43ef336df233d72edcc7a3f5f65fe36809e2047f4551b57aa1ebaf3b17d
SHA1 hash: 9b46ab9885768e8fe101db9545ee88e733058465
MD5 hash: b552f5c14a03a6dab1d1227958ea1126
humanhash: nine-equal-sad-quiet
File name:fusser_setup.msi
Download: download sample
Signature HijackLoader
Create hunting rule
File size:5'120'000 bytes
First seen:2026-02-06 12:05:19 UTC
Last seen:2026-02-06 12:48:27 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:rwLz1Vy7mA4dWVqejlXJalaeCs9ARYR/7dYeEPi1DEWj5bAoZoEG:rwtVzAbBlZaz7xptEQwi1Y
Threatray 22 similar samples on MalwareBazaar
TLSH T15A36334B27CA9562EF830B78A4C0D0F24BA44CAFD770C0569609B5EE3637B2BC76D155
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter SquiblydooBlog
Tags:HIjackLoader msi signed

Code Signing Certificate

Organisation:Wenshui County Hengjiu Zhongtai Information Consulting Co., Ltd.
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2026-01-23T00:00:00Z
Valid to:2027-01-23T23:59:59Z
Serial number: 256039fe43338724270197a2c048ec15
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: ef48f632dad500c0517c8aec3e03e2680b29aff5c837844177969dda4f33c0b0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
57
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
HijackLoader MSI
Details
HijackLoader
embedded components, an injection process, and filepaths
HijackLoader
an XOR key and XOR-decrypted/LZNT1 decompressed component
MSI
an embedded setup program or component
Link:
https://research.acce.ciphertechsolutions.com/results/5f2270b5-2635-4d95-a554-5df03f1d43e5/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/52486/
Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6985d936ae5379bb660a1496
Tags:
n/a
Verdict:
Suspicious
Labled as:
TrojanDownloader.Rugmi
Link:
https://www.hybrid-analysis.com/sample/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf
Result
Verdict:
SUSPICIOUS
Link:
https://labs.inquest.net/dfi/sha256/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
msi
Detections:
Trojan-Downloader.Win64.Agent.eey Trojan.Win64.Reflo.sb Trojan.Win32.Strab.sb Trojan.Win32.Penguish.sb
Link:
https://opentip.kaspersky.com/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf/results?tab=lookup
Score:
83%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf/
Verdict:
Malicious
Threat:
Family.HIJACKLOADER
Link:
https://tip.neiki.dev/file/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rsqx7b3qx5l5mnis6vujyph2udvcq3fvkm3flfopj3pccqites7q._file
Verdict:
malicious
Label(s):
hijackloader
Create hunting rule
Similar samples:
10c6b812fd573728d2d8ef6d3b523fdc3393912f2e14d48965d9abf5212f89c9
HijackLoader
4d95e661c6160b85f4320c21d44da333b97ba485f2969015c93cba9e81cdfc82
HijackLoader
8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf
HijackLoader
8e1b44f1a7580fb06f5a61893edde1228b512422868f5a407e51232f6c337110
HijackLoader
934794cbbc5d034b15af18416c1f13a0f94b2734181570dc96b497a5271d7451
HijackLoader
a5ea2fae2fa215baee8f129be1f2deb650295982764839c9ceb9a3120e7421c6
HijackLoader
cff7be264479e94285bb66b122e5a6d47c4220c7285a981c667fe354e549a69a
HijackLoader
d8a84f98d972ced0618141b50d136a732cf613cd9f06138867191ca9cac97638
HijackLoader
error
HijackLoader
+ 12 additional samples on MalwareBazaar
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader discovery loader persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/260206-n9tpvsbv9h/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Badlisted process makes network request
Enumerates connected drives
Detects HijackLoader (aka IDAT Loader)
HijackLoader, IDAT loader, Ghostulse,
Hijackloader family
Malware family:
HijackLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8ca17f8770bf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/52486/

Comments