🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a
SHA3-384 hash: 8a64c1eaaa233c2e71f814be45179aad7351e0fb69179c98e48166e3137ba42f18cc6f00800eb4fcda9ec2b2b49b7142
SHA1 hash: 859b02d6ee1c3328b6e9bec49290427b029e9548
MD5 hash: 2e4eededd83f7aeb47ba963aa61a8ef6
humanhash: three-neptune-venus-gee
File name:U11.msi
Download: download sample
File size:40'960 bytes
First seen:2026-11-11 17:06:29 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 768:U0SJfd7oirqd+XMDZlMM27xtLgWMbCkGWvBz/z/i:0lU4UjtaSbx1BS
TLSH T166037C0AB6448336D9450B32466F87D48F766C5CCFB321123AEE774D2D729A066F78E8
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika unknown
Reporter smica83
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/05a9555d-2811-4ad7-a0a7-257b440449de/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99466/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af4a0c1beffd05f052b1122
Tags:
rapid robin
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Searching for synchronization primitives
Creating a file in the Windows subdirectories
Creating a file
Running batch commands
Creating a file in the %temp% directory
Launching a process
Launching cmd.exe command interpreter
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a process from a recently created file
Creating a process with a hidden window
Possible injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 CAB cmd findstr installer lolbin opendir powershell timeout wscript
Link:
https://www.filescan.io/uploads/6af4a0bdb8a5b8371ad8693f/reports/d80c16ed-bef8-4850-84bb-4b6139859ae0/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2004230
Signature
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious command line found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected BAT Obfuscated Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2004230 Sample: U11.msi Startdate: 11/11/2026 Architecture: WINDOWS Score: 100 91 rpc.mevblocker.io 2->91 93 rpc.flashbots.net 2->93 95 9 other IPs or domains 2->95 107 Suricata IDS alerts for network traffic 2->107 109 Malicious sample detected (through community Yara rule) 2->109 111 Yara detected BAT Obfuscated Downloader 2->111 113 4 other signatures 2->113 11 msiexec.exe 85 45 2->11         started        14 cmd.exe 2->14         started        17 svchost.exe 1 1 2->17         started        20 msiexec.exe 3 2->20         started        signatures3 process4 dnsIp5 83 C:\Users\user\AppData\Local\...\regb1jblz.vbs, ASCII 11->83 dropped 85 C:\Users\user\AppData\...\RunPostSetup.cmd, DOS 11->85 dropped 87 C:\Users\user\AppData\...\DW8VnS1rqWvH.cfg, ASCII 11->87 dropped 22 cmd.exe 1 11->22         started        139 Suspicious powershell command line found 14->139 141 Suspicious command line found 14->141 143 Wscript called in batch mode (surpress errors) 14->143 25 cmd.exe 14->25         started        27 conhost.exe 14->27         started        89 127.0.0.1 unknown unknown 17->89 file6 signatures7 process8 signatures9 115 Suspicious powershell command line found 22->115 117 Bypasses PowerShell execution policy 22->117 119 Suspicious command line found 22->119 29 cmd.exe 2 22->29         started        32 conhost.exe 22->32         started        121 Wscript called in batch mode (surpress errors) 25->121 34 cmd.exe 25->34         started        36 wscript.exe 25->36         started        38 cmd.exe 25->38         started        40 6 other processes 25->40 process10 signatures11 131 Suspicious command line found 29->131 133 Wscript called in batch mode (surpress errors) 29->133 42 wscript.exe 29->42         started        45 cmd.exe 1 29->45         started        47 cmd.exe 1 29->47         started        57 6 other processes 29->57 135 Suspicious powershell command line found 34->135 49 powershell.exe 34->49         started        137 WScript reads language and country specific registry keys (likely country aware script) 36->137 51 AppLauncher.exe 36->51         started        53 powershell.exe 38->53         started        55 powershell.exe 40->55         started        process12 dnsIp13 123 Windows Scripting host queries suspicious COM object (likely to drop second stage) 42->123 125 WScript reads language and country specific registry keys (likely country aware script) 42->125 61 AppLauncher.exe 42->61         started        127 Suspicious powershell command line found 45->127 64 powershell.exe 8 7 45->64         started        67 powershell.exe 7 47->67         started        129 Found suspicious powershell code related to unpacking or dynamic code loading 49->129 69 conhost.exe 51->69         started        97 nodejs.org 104.16.212.131, 443, 49706, 49713 CLOUDFLARENET-CloudflareIncUS Canada 57->97 75 C:\Users\user\AppData\Local\...\which.js, Node.js 57->75 dropped 77 C:\Users\user\AppData\Local\...\bin.js, Node.js 57->77 dropped 79 C:\Users\user\AppData\...\qrcode-terminal.js, Node.js 57->79 dropped 81 18 other files (none is malicious) 57->81 dropped 71 powershell.exe 7 57->71         started        file14 signatures15 process16 dnsIp17 99 0xrpc.io 146.19.24.104, 443, 49716, 49727 MEVSPACEPL Poland 61->99 101 eth.api.pocket.network 88.99.216.186, 443, 49717, 49726 HETZNER-ASDE Germany 61->101 103 7 other IPs or domains 61->103 73 conhost.exe 61->73         started        105 Found suspicious powershell code related to unpacking or dynamic code loading 64->105 signatures18 process19
Score:
49%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a
Verdict:
Malware
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:MSZIP COM Behavior Trace DeObfuscated Obfuscated Office Document PowerShell T1027 T1059 T1059.001 T1059.005 T1059.007 VBScript WScript.Shell
Link:
https://app.malva.re/file/2e4eededd83f7aeb47ba963aa61a8ef6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r4xdoop4lgrxmi7krlaxql3xhk3gndurbb4j7s34zkntkbfe4afa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261111-vm2khsax4t/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
cURL User-Agent
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Windows directory
Queries registry keys for unique system GUIDs
Executes a VBScript file via the Windows Script Host.
Enumerates connected drives
Checks computer location settings
Creates a file in the Startup directory
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Malware Family:
n/a
Verdict:
Suspicious
Tags:
loader
YARA:
Wscript
Link:
https://app.threat.zone/submission/5501a9a5-842e-4e42-b74f-78ffb66a4751
Malware Family:
ole2
Create hunting rule
Malicious:
True
Tags:
usb-check msi
Link:
https://intel.virussign.com/intelligence/file/8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/99466/

Comments