🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b3dca0664de057a9e56eb68bd00d5b0250496bba64a8f398351b243cb4a340f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b3dca0664de057a9e56eb68bd00d5b0250496bba64a8f398351b243cb4a340f
SHA3-384 hash: 46b3782b70415a8b0ae793b8448cfef8312c347da82f8a4d37f06246ffd4748ee7b1a74251eb910fe06a0ba2771ffc04
SHA1 hash: 4e010f7f929294772affc3990f6acee2e85f8341
MD5 hash: dcae184ef31a93b263ab112b5e112b91
humanhash: pip-moon-green-network
File name:31919.msi
Download: download sample
File size:2'115'584 bytes
First seen:2026-10-12 20:41:39 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 24576:wanjw20jzvpNAAxAF3ETOBKkrh4cdhTQKkcR2wYTRCYsNMb:znjd0fpu+AFD0yhRPTQzcH3HE
TLSH T195A55D636A50600542B5A4FABEBD5E37694F3409101A998EFFD34B8AF52E6FC4C02D1F
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter smica83
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/087c0ac2-1466-4db2-9ec5-737064741a92/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91591/
Verdict:
Malicious
Score:
70.0%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad10b4bf4e17c78f715dd00
Tags:
virus shell
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
CAB evasive installer lolbin powershell wix wscript
Link:
https://www.filescan.io/uploads/6acd462d39da26cc872c1abb/reports/ffab8c66-a027-4340-b5e3-3d84e1ad363b/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/9b3dca0664de057a9e56eb68bd00d5b0250496bba64a8f398351b243cb4a340f
Verdict:
Malicious
File Type:
msi
First seen:
2026-10-13T00:45:00Z UTC
Last seen:
2026-10-13T02:20:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9b3dca0664de057a9e56eb68bd00d5b0250496bba64a8f398351b243cb4a340f/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1986185
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Command shell drops VBS files
Contains functionality to inject code into remote processes
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Powershell connects to network
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1986185 Sample: 31919.msi Startdate: 12/10/2026 Architecture: WINDOWS Score: 100 48 zgrongbo.com 2->48 50 nsgggg.com 2->50 52 ipinfo.io 2->52 66 Suricata IDS alerts for network traffic 2->66 68 Antivirus detection for URL or domain 2->68 70 Sigma detected: WScript or CScript Dropper 2->70 72 5 other signatures 2->72 10 msiexec.exe 75 35 2->10         started        13 msiexec.exe 3 2->13         started        signatures3 process4 file5 42 C:\Users\user\AppData\Local\...\dCm4cBCv.bat, DOS 10->42 dropped 15 cmd.exe 4 10->15         started        process6 file7 44 C:\Users\user\AppData\Local\Temp\b7806.vbs, ASCII 15->44 dropped 60 Wscript starts Powershell (via cmd or directly) 15->60 62 Command shell drops VBS files 15->62 64 Wscript called in batch mode (surpress errors) 15->64 19 wscript.exe 1 15->19         started        22 powershell.exe 22 15->22         started        25 conhost.exe 15->25         started        signatures8 process9 file10 74 Suspicious powershell command line found 19->74 76 Wscript starts Powershell (via cmd or directly) 19->76 78 Bypasses PowerShell execution policy 19->78 86 3 other signatures 19->86 27 powershell.exe 49 19->27         started        40 C:\Users\user\AppData\...\j3qccofq.cmdline, Unicode 22->40 dropped 80 Contains functionality to inject code into remote processes 22->80 82 Found suspicious powershell code related to unpacking or dynamic code loading 22->82 84 Unusual module load detection (module proxying) 22->84 31 csc.exe 3 22->31         started        signatures11 process12 dnsIp13 54 zgrongbo.com 172.67.146.75, 443, 49710 CLOUDFLARENET-CloudflareIncUS Canada 27->54 56 ipinfo.io 34.117.59.81, 443, 49709 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 27->56 58 nsgggg.com 104.21.88.172, 443, 49711 CLOUDFLARENET-CloudflareIncUS Canada 27->58 88 Powershell connects to network 27->88 34 WerFault.exe 28 16 27->34         started        36 conhost.exe 27->36         started        46 C:\Users\user\AppData\Local\...\j3qccofq.dll, PE32 31->46 dropped 38 cvtres.exe 1 31->38         started        file14 signatures15 process16
Score:
98%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/9b3dca0664de057a9e56eb68bd00d5b0250496bba64a8f398351b243cb4a340f
Verdict:
Malware
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:MSZIP DeObfuscated Office Document PowerShell T1027 T1059.001 T1059.005
Link:
https://app.malva.re/file/dcae184ef31a93b263ab112b5e112b91
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b3dca0664de057a9e56eb68bd00d5b0250496bba64a8f398351b243cb4a340f/
Threat name:
Script-PowerShell.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-10-10 22:06:31 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
5 of 38 (13.16%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tm64ubte3ycxvhsw5nul2agvwasqjfv3uzfi6omdkgzehs2kgqhq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261012-zq5hssez9y/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
Executes a command shell one-liner
Drops file in Windows directory
Executes a VBScript file via the Windows Script Host.
Enumerates connected drives
Looks up external IP address via web service
Checks computer location settings
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/91591/

Comments