🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91cf205a9dcebefc3dbcf0813908c2aa245f8225734dcc87d9e08224f5d4ec5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91cf205a9dcebefc3dbcf0813908c2aa245f8225734dcc87d9e08224f5d4ec5d
SHA3-384 hash: 7e31a43239ec4652d1b5eb6d52a1784578aa9c097039e50912ce12ae39e31d16ca98d7989d03b2c5a2fb56ac159c3b83
SHA1 hash: ab35ee8e16d3faea5788b87c6b5b6919a65d328a
MD5 hash: fc3387fe006ae2579cde7b5aa3c739f2
humanhash: double-oven-oven-avocado
File name:XB7W2TRKW7WG_19SI0B7FBSUF4_windows_x64.msi
Download: download sample
File size:3'346'432 bytes
First seen:2026-10-08 06:28:54 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:PBkFzdzZJe6Ueev0ShdIu8t8oaWLb+VCbiLDHs7WZkLneHr0Nu:PBqu10STImVwNgbULor4
TLSH T146F5238176940176E56B0635CA25B5A06B36FC101FF08A1E335AF37C6E7F390E936B62
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter KodaDr
Tags:msi RemoteAdmin signed SuperOps

Code Signing Certificate

Organisation:Superops Inc.
Issuer:Sectigo Public Code Signing CA R36
Algorithm:sha384WithRSAEncryption
Valid from:2023-04-14T00:00:00Z
Valid to:2026-07-13T23:59:59Z
Serial number: 3e4f07839d574985804da55c80b5d9c0
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 9b0a013788114170919cf3effbc0da9fb8d90ce8a960c88ace6a82a0153f7690
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
LV LV
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/3f948d18-605e-4b82-b633-30b81a3e9bda/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91050/
Detection(s):
SecuriteInfo.com.W32.SuperOps.C.tr.28327.1589.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm base64 CAB crypto expand expired-cert fingerprint golang hacktool installer installer lolbin overlay packed reconnaissance rundll32 signed
Link:
https://www.filescan.io/uploads/6ac7383e00cf64e6f6729601/reports/d58331f2-b0da-4218-a5e4-d4359fd1ca39/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/91cf205a9dcebefc3dbcf0813908c2aa245f8225734dcc87d9e08224f5d4ec5d
Verdict:
Adware
File Type:
msi
First seen:
2026-02-02T13:55:00Z UTC
Last seen:
2026-10-09T20:36:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/91cf205a9dcebefc3dbcf0813908c2aa245f8225734dcc87d9e08224f5d4ec5d/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1950189
Signature
Bypasses PowerShell execution policy
Creates / moves files in alternative data streams (ADS)
Creates files in the system32 config directory
Enables network access during safeboot for specific services
Encrypted powershell cmdline option found
Installs new ROOT certificates
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: HackTool - Covenant PowerShell Launcher
Sigma detected: Potential PowerShell Command Line Obfuscation
Suspicious powershell command line found
Tries to detect virtualization through RDTSC time measurements
Uses Register-ScheduledTask to add task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1950189 Sample: XB7W2TRKW7WG_19SI0B7FBSUF4_... Startdate: 30/07/2026 Architecture: WINDOWS Score: 64 144 superops-agent-upgrade-prod.s3.us-east-2.amazonaws.com 2->144 146 ingress.us1.coralogix.com 2->146 148 19 other IPs or domains 2->148 162 Multi AV Scanner detection for submitted file 2->162 164 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 2->164 166 Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines) 2->166 168 12 other signatures 2->168 12 superops.exe 2->12         started        16 msiexec.exe 87 36 2->16         started        19 powershell.exe 2->19         started        21 7 other processes 2->21 signatures3 process4 dnsIp5 156 crl.comodoca.com.cdn.cloudflare.net 104.18.38.233, 49860, 49861, 49871 CLOUDFLARENET-CloudflareIncUS Canada 12->156 158 172.64.149.23, 49862, 49872, 80 CLOUDFLARENET-CloudflareIncUS Canada 12->158 160 4 other IPs or domains 12->160 182 Suspicious powershell command line found 12->182 184 Encrypted powershell cmdline option found 12->184 23 powershell.exe 12->23         started        28 winget.exe 12->28         started        30 powershell.exe 12->30         started        40 9 other processes 12->40 92 C:\Program Files\...\superopssetup.exe, PE32+ 16->92 dropped 94 C:\Windows\Installer\MSI7284.tmp, PE32+ 16->94 dropped 96 C:\Windows\Installer\MSI6D04.tmp, PE32+ 16->96 dropped 32 msiexec.exe 16->32         started        34 msiexec.exe 16->34         started        98 C:\Program Files\...\upgradeScheduler.log, ASCII 19->98 dropped 36 updmgr.exe 19->36         started        38 conhost.exe 19->38         started        100 C:\Users\user\AppData\Local\...\MSI5D63.tmp, PE32 21->100 dropped 42 2 other processes 21->42 file6 signatures7 process8 dnsIp9 150 www.islonline.net 170.187.160.42, 443, 49881 AKAMAI-LINODE-APAkamaiConnectedCloudSG United States 23->150 112 C:\...\superops-rd-agent-installer.exe, PE32 23->112 dropped 174 Creates files in the system32 config directory 23->174 176 Powershell drops PE file 23->176 44 superops-rd-agent-installer.exe 23->44         started        47 conhost.exe 23->47         started        152 mr-b01.tm-azurefd.net 150.171.109.66, 443, 49911 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 28->152 178 Creates / moves files in alternative data streams (ADS) 28->178 49 conhost.exe 28->49         started        114 stdout, ASCII 30->114 dropped 180 Loading BitLocker PowerShell Module 30->180 51 conhost.exe 30->51         started        53 rundll32.exe 5 32->53         started        55 rundll32.exe 6 32->55         started        116 stderr, ASCII 36->116 dropped 57 conhost.exe 36->57         started        59 11 other processes 40->59 118 C:\...\ISLOnlineAgentforSuperOps.exe.2.dmp, Mini 42->118 dropped 61 2 other processes 42->61 file10 signatures11 process12 file13 120 C:\...\ISLAlwaysOn_setup.exe, PE32 44->120 dropped 122 C:\...\ISLAlwaysOnCheck.exe, PE32 44->122 dropped 63 ISLAlwaysOnCheck.exe 44->63         started        124 Microsoft.Deployme...indowsInstaller.dll, PE32 53->124 dropped 126 C:\Windows\Installer\...\InstallerCA_x64.dll, PE32+ 53->126 dropped 65 superopssetup.exe 3 26 53->65         started        128 Microsoft.Deployme...indowsInstaller.dll, PE32 55->128 dropped 130 C:\Windows\Installer\...\InstallerCA_x64.dll, PE32+ 55->130 dropped process14 dnsIp15 70 ISLAlwaysOn_setup.exe 63->70         started        140 serv.superops.ai 3.17.221.254, 443, 49866, 49868 AMAZON-02-AmazoncomIncUS United States 65->140 142 s3-r-w.us-east-2.amazonaws.com 3.5.128.81, 443, 49867 AMAZON-02-AmazoncomIncUS United States 65->142 102 C:\Program Files\superopsrmm\...\superops.exe, PE32+ 65->102 dropped 104 C:\Program Files\...\updmgr_new.exe, PE32+ 65->104 dropped 106 C:\Program Files\...\updmgr.exe (copy), PE32+ 65->106 dropped 108 5 other files (none is malicious) 65->108 dropped 170 Installs new ROOT certificates 65->170 73 superops.exe 6 2 65->73         started        75 conhost.exe 65->75         started        77 updmgr.exe 65->77         started        file16 signatures17 process18 file19 110 C:\Windows\Temp\...\ISLAlwaysOn_setup.tmp, PE32 70->110 dropped 79 ISLAlwaysOn_setup.tmp 70->79         started        82 ROUTE.EXE 73->82         started        process20 file21 132 C:\...\ISLOnlineAgentforSuperOps.exe (copy), PE32 79->132 dropped 134 C:\Windows\Temp\...\win_registry.dll, PE32 79->134 dropped 136 C:\Windows\Temp\...\islinstaller.dll, PE32 79->136 dropped 138 42 other files (none is malicious) 79->138 dropped 84 ISLOnlineAgentforSuperOps.exe 79->84         started        87 ISLOnlineAgentforSuperOps.exe 79->87         started        90 ISLOnlineAgentforSuperOps.exe 79->90         started        process22 dnsIp23 172 Enables network access during safeboot for specific services 84->172 154 alwayson-erurpac.islonline.net 104.192.4.120, 443, 49898, 49899 IONOS-ASThisisthejointnetworkforIONOSFasthostsArsys11MailandMediaand11TelecomFormerlyknownas11InternetSEDE United States 87->154 signatures24
Score:
10%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/91cf205a9dcebefc3dbcf0813908c2aa245f8225734dcc87d9e08224f5d4ec5d
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
.Net CAB:COMPRESSION:LZX CAB:COMPRESSION:MSZIP Executable Managed .NET Office Document PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) SOS: 0.21 SOS: 0.27
Link:
https://app.malva.re/file/fc3387fe006ae2579cde7b5aa3c739f2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91cf205a9dcebefc3dbcf0813908c2aa245f8225734dcc87d9e08224f5d4ec5d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-02-03 18:52:03 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
8 of 36 (22.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=shhsawu5z27pypn46catscgcvisf7arfong4zb6z4cbcj5ou5roq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution installer persistence privilege_escalation ransomware spyware trojan
Link:
https://tria.ge/reports/261008-g81y8adf33/
Behaviour
Uses Volume Shadow Copy service COM API
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: AddClipboardFormatListener
Modifies system certificate store
Modifies registry class
Modifies data under HKEY_USERS
Enumerates system info in registry
Checks SCSI registry key(s)
Inno Setup is an open-source installation builder for Windows applications.
Event Triggered Execution: Installer Packages
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Drops file in Windows directory
Drops file in Program Files directory
Drops file in System32 directory
Obfuscated Files or Information: Command Obfuscation
Network Share Discovery
Enumerates connected drives
Command and Scripting Interpreter: PowerShell
Checks whether UAC is enabled
Checks installed software on the system
Modifies file permissions
Loads dropped DLL
Executes dropped EXE
Downloads MZ/PE file
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/91cf205a9dcebefc3dbcf0813908c2aa245f8225734dcc87d9e08224f5d4ec5d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 91cf205a9dcebefc3dbcf0813908c2aa245f8225734dcc87d9e08224f5d4ec5d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3793697/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/91050/

Comments