MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c9baabdd7b08ca2f9e76be7987780dcb25d0ae45dc2d5f1962fd5ca8e42c129. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9c9baabdd7b08ca2f9e76be7987780dcb25d0ae45dc2d5f1962fd5ca8e42c129
SHA3-384 hash:	a3961da07fa783f1b1394031c11af22b79ff72d1c3de09bb9dc4644a61be10c3ac73a2c0cacd1a756b7559d8ccbd38f4
SHA1 hash:	8928e83e5211d5c7ad779e702c8f2466ac3752bb
MD5 hash:	579e45fa55c874b4a45e35d768e520d8
humanhash:	happy-carolina-robert-mango
File name:	9c9baabdd7b08ca2.msi
Download:	download sample
File size:	88'683'520 bytes
First seen:	2026-11-13 01:40:11 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:HwyX3aBYOLbD6TY/dRvhrWorchGgsU27ehxIlOX3k/lVvMRhuZSKc4Do0nejkXsx:nqYOLPd7fgs+hR3k/Hn1s0ejkXsT
TLSH	T121183333324ECF76C6BF5830447A5A9F01657D630B3190E7A39CAC3AA4B64C29675E93
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	Tuxxin
Tags:	msi

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

79

Origin country :

US

Vendor Threat Intelligence

ACCE MSI_FileType

Malware configuration found for:

MSI

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7690b3bb-211a-4639-a842-52918a69a08e/

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af66a900a71acf937da5776

Tags:

phishing trojan overt remo

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating synchronization primitives

Searching for synchronization primitives

Creating a file in the Windows subdirectories

Creating a file in the %temp% directory

Creating a process from a recently created file

Deleting a recently created file

Creating a file

Moving a recently created file

Launching a process

Creating a process with a hidden window

Creating a file in the Program Files subdirectories

Creating a service

Launching a service

Loading a suspicious library

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Enabling autorun for a service

Enabling autorun by creating a file

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

active-directory anti-debug anti-vm base64 CAB cmd crypto expired-cert explorer fingerprint hacktool installer large-file lolbin obfuscated packed reconnaissance reconnaissance wix

Link:

https://www.filescan.io/uploads/6af66a87ea24c8934104ac5d/reports/4c719ad2-afd8-45bb-a9fe-8a2d86cc3689/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/9c9baabdd7b08ca2f9e76be7987780dcb25d0ae45dc2d5f1962fd5ca8e42c129

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/2005095

Signature

Bypasses PowerShell execution policy

Joe Sandbox ML detected suspicious sample

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/9c9baabdd7b08ca2f9e76be7987780dcb25d0ae45dc2d5f1962fd5ca8e42c129

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tsn2vpoxwcgkf6phnptzq54a3szf2cxelxbnl4mwf7k4vdscyeuq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution installer persistence privilege_escalation spyware stealer trojan

Link:

https://tria.ge/reports/261113-b3q9yayx2l/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Modifies system certificate store

Modifies registry class

Modifies data under HKEY_USERS

Enumerates system info in registry

Checks processor information in registry

Inno Setup is an open-source installation builder for Windows applications.

Modifies trusted root certificate store through registry

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Event Triggered Execution: Installer Packages

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Enumerates video capture drivers

Drops file in Windows directory

Drops file in Program Files directory

Looks up external IP address via web service

Enumerates connected drives

Drops desktop.ini file(s)

Checks installed software on the system

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

VirusSign agentb

Malware Family:

agentb

Alert

Create hunting rule

Malicious:

True

Tags:

msi

Link:

https://intel.virussign.com/intelligence/file/9c9baabdd7b08ca2f9e76be7987780dcb25d0ae45dc2d5f1962fd5ca8e42c129

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.