🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9437275ee94d0a2b491181366be2ef6f0ac106599516bb7ab3c1a5c5df0a5021. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Nitol


Vendor detections: 5


Intelligence 5 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9437275ee94d0a2b491181366be2ef6f0ac106599516bb7ab3c1a5c5df0a5021
SHA3-384 hash: c9ac101d302e21555caeed584b54135961f5f731e02a2f8a44112a285d6a9c58d51bfe612089c8b691aa2acbc049b6fd
SHA1 hash: 7b6b2e7b80fcc8460c3d0bba7bbfb337f7067fa9
MD5 hash: a4e34f3ab12aef758dfdce6292194a2d
humanhash: hotel-undress-summer-queen
File name:MSTeams.msi
Download: download sample
Signature Nitol
Create hunting rule
File size:52'808'192 bytes
First seen:2025-07-12 19:25:46 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 1572864:g846uc5ilkLVU84IvqeutVtzdNO2IdATbei+BVvfeV1AId:gquQXtvqvfOWX6FA2
TLSH T1BBC73320F1637855E62F57BFE478AF8D40317DE1731BD5AB63B87BA989B098250B1803
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter abuse_ch
Tags:msi Nitol

Intelligence

File Origin
# of uploads :
1
# of downloads :
33
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Clean
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68727fd4900df8e7f86a2ffa
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
cmd lolbin obfuscated remote update wix
Link:
https://www.filescan.io/uploads/6872b6efa15b22faa8afbbfd/reports/09a9451e-28c1-4cb1-bd09-f998b70a7e63/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/9437275ee94d0a2b491181366be2ef6f0ac106599516bb7ab3c1a5c5df0a5021
Result
Threat name:
MicroClip, Nitol
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1734935
Signature
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Contain functionality to detect virtual machines
Contains functionality to check for running processes (XOR)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected MicroClip
Yara detected Nitol
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1734935 Sample: MSTeams.msi Startdate: 12/07/2025 Architecture: WINDOWS Score: 100 115 Malicious sample detected (through community Yara rule) 2->115 117 Antivirus detection for dropped file 2->117 119 Multi AV Scanner detection for dropped file 2->119 121 7 other signatures 2->121 9 msiexec.exe 18 52 2->9         started        12 msiexec.exe 12 2->12         started        14 ldmnq.exe 2->14         started        16 8 other processes 2->16 process3 dnsIp4 69 C:\Windows\Installer\MSIB3F2.tmp, PE32+ 9->69 dropped 71 C:\Windows\Installer\MSI951D.tmp, PE32 9->71 dropped 73 C:\Windows\Installer\MSI949F.tmp, PE32 9->73 dropped 83 5 other malicious files 9->83 dropped 20 msiexec.exe 9 18 9->20         started        25 msiexec.exe 9->25         started        27 msiexec.exe 9->27         started        75 C:\Users\user\AppData\Local\...\MSI640F.tmp, PE32 12->75 dropped 77 C:\Users\user\AppData\Local\...\MSI63B0.tmp, PE32 12->77 dropped 79 C:\Users\user\AppData\Local\...\MSI6023.tmp, PE32 12->79 dropped 85 4 other malicious files 12->85 dropped 81 C:\Users\user\AppData\Local\...\Update.exe, PE32 14->81 dropped 29 Update.exe 14->29         started        87 23.9.183.29 AKAMAI-ASUS United States 16->87 89 127.0.0.1 unknown unknown 16->89 105 Contains functionality to check for running processes (XOR) 16->105 107 Changes security center settings (notifications, updates, antivirus, firewall) 16->107 31 MpCmdRun.exe 16->31         started        file5 signatures6 process7 dnsIp8 91 103.235.46.115 BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd Hong Kong 20->91 65 C:\ProgramData\...\AmberCanyon.dll, PE32+ 20->65 dropped 123 Query firmware table information (likely to detect VMs) 20->123 125 Maps a DLL or memory area into another process 20->125 33 TrustedInstaller.exe 8 20->33         started        93 23.221.242.10 TISCALI-IT United States 29->93 95 104.208.16.95 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 29->95 97 3 other IPs or domains 29->97 67 C:\Windows\Temp\MSTeams.msix, Zip 29->67 dropped 36 conhost.exe 31->36         started        file9 signatures10 process11 signatures12 109 Uses schtasks.exe or at.exe to add and modify task schedules 33->109 111 Writes to foreign memory regions 33->111 113 Maps a DLL or memory area into another process 33->113 38 cmd.exe 1 33->38         started        40 cmd.exe 33->40         started        42 svchost.exe 33->42 injected 45 4 other processes 33->45 process13 dnsIp14 47 tasklist.exe 1 38->47         started        49 conhost.exe 38->49         started        51 findstr.exe 38->51         started        61 6 other processes 38->61 53 conhost.exe 40->53         started        55 tasklist.exe 40->55         started        57 findstr.exe 40->57         started        63 5 other processes 40->63 99 192.168.2.1 unknown unknown 42->99 101 224.0.0.22 unknown Reserved 42->101 103 137.220.202.63 BCPL-SGBGPNETGlobalASNSG Singapore 45->103 59 conhost.exe 45->59         started        process15
Score:
11%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/9437275ee94d0a2b491181366be2ef6f0ac106599516bb7ab3c1a5c5df0a5021
Gathering data
Threat name:
Win32.PUA.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-07-12 15:37:22 UTC
File Type:
Binary (Archive)
Extracted files:
7784
AV detection:
7 of 38 (18.42%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sq3soxxjjufcwsirqe3gxyxpn4fmcbszsullw6vtygs4lxykkaqq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/250712-x5qxvafq5z/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Loads dropped DLL
Enumerates connected drives
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/52210a2b-79b1-4eef-9a1d-3f170a194959
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments