MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 979c729256fbbc3a8862ce29cc33dee295a2ff2cce145123d3a87712863985ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	979c729256fbbc3a8862ce29cc33dee295a2ff2cce145123d3a87712863985ef
SHA3-384 hash:	92a772bc2323145fadf5e575740def840f0779b9ba75cdc2f7c7f7fedf5e56724f78f104bfe4dd9469862ec5bd2a6a42
SHA1 hash:	5acce8e146121fb550d217b3cd88b2978fdb1fb8
MD5 hash:	1d5afce5c947336477797e7d52f66ae0
humanhash:	saturn-solar-four-snake
File name:	b11.msi
Download:	download sample
File size:	37'368'320 bytes
First seen:	2026-10-09 19:14:59 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	786432:im3izW8Sg0RpD3vKGyqB/Wwm7vVa9Vh23EDUFGHf5CWfghFY:imSz9v0R2GZP9VA3EDuGHfihFY
TLSH	T10787336E383F612FF46EE87D1D35A65D95F2B12260460C4AA3393B5314EF6E071F824A
TrID	88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	x86
Tags:	EtherHiding msi RAT

x86rax

Delivered via Teams SE. TA manipulated user to run malicious CMD.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

wix

Link:

https://www.filescan.io/uploads/6ac93d559d0cf5c577d11794/reports/d396c7ba-d628-4507-98bc-39a08f6f1bcb/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/979c729256fbbc3a8862ce29cc33dee295a2ff2cce145123d3a87712863985ef

Verdict:

Malicious

File Type:

msi

First seen:

2026-10-09T18:12:00Z UTC

Last seen:

2026-10-11T12:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/979c729256fbbc3a8862ce29cc33dee295a2ff2cce145123d3a87712863985ef/results?tab=lookup

Score:

97%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/261009-xygetsty7p/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Enumerates connected drives

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

https://x.com/x86shell/status/2108634485348507896

Delivery method

Other

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample