🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0
SHA3-384 hash: 7b905dbb8dfae3bc996d60fc78d2dc4401e4281340d8a4f43f7eb57a36cb1bfa91e274039930aa3219b963cc842bf877
SHA1 hash: 2100f3b692171ff1a0da849d098978479b7597d8
MD5 hash: 4118241b2cf74cc793e75e205a4aaa8f
humanhash: rugby-winter-east-crazy
File name:KB59985.msi
Download: download sample
File size:36'864 bytes
First seen:2026-10-29 18:38:27 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 768:J4MIOGTXMwlAfMGyXED1EzHQn9eWMbCbGmYtbYN/0f:2MdC/l8yIEzHQ9obIjYtf
TLSH T1FEF26D52B5449332C9460B76091FD7E08F799C68CFA361123BDAB30C7D736E166EA8E0
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika doc
Reporter smica83
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a39c59c8-cb27-4e9b-ab76-ad575901ad27/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95985/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae392d4b121dd519dcea42d
Tags:
infosteal rapid robin
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1994859
Signature
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Drops script at startup location
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Uses WMIC command to query system information (often done to detect virtual machines)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1994859 Sample: KB59985.msi Startdate: 29/10/2026 Architecture: WINDOWS Score: 100 138 mainnet.gateway.tenderly.co 2->138 140 www.python.org 2->140 142 10 other IPs or domains 2->142 154 Suricata IDS alerts for network traffic 2->154 156 Malicious sample detected (through community Yara rule) 2->156 158 Sigma detected: Drops script at startup location 2->158 160 5 other signatures 2->160 12 msiexec.exe 86 46 2->12         started        15 cmd.exe 2->15         started        18 cmd.exe 2->18         started        20 2 other processes 2->20 signatures3 process4 file5 126 C:\Users\user\AppData\Local\...\xBoInRMFWK.py, ASCII 12->126 dropped 128 C:\Users\user\AppData\Local\...\run1w7zzg.vbs, ASCII 12->128 dropped 130 C:\Users\user\AppData\...\DeployFinalize.cmd, DOS 12->130 dropped 22 cmd.exe 1 12->22         started        192 Suspicious powershell command line found 15->192 25 cmd.exe 15->25         started        27 conhost.exe 15->27         started        29 conhost.exe 18->29         started        31 ConfigEngine.exe 18->31         started        signatures6 process7 signatures8 172 Suspicious powershell command line found 22->172 174 Bypasses PowerShell execution policy 22->174 176 Suspicious command line found 22->176 33 cmd.exe 3 22->33         started        36 conhost.exe 22->36         started        178 Wscript called in batch mode (surpress errors) 25->178 38 wscript.exe 25->38         started        40 cmd.exe 25->40         started        42 cmd.exe 25->42         started        44 4 other processes 25->44 process9 signatures10 148 Suspicious powershell command line found 33->148 150 Suspicious command line found 33->150 46 wscript.exe 33->46         started        49 cmd.exe 1 33->49         started        51 tar.exe 33->51         started        62 6 other processes 33->62 152 WScript reads language and country specific registry keys (likely country aware script) 38->152 54 ConfigEngine.exe 38->54         started        56 powershell.exe 40->56         started        58 powershell.exe 42->58         started        60 powershell.exe 44->60         started        process11 dnsIp12 180 Windows Scripting host queries suspicious COM object (likely to drop second stage) 46->180 182 Suspicious execution chain found 46->182 184 WScript reads language and country specific registry keys (likely country aware script) 46->184 65 ConfigEngine.exe 46->65         started        186 Suspicious powershell command line found 49->186 70 powershell.exe 7 49->70         started        118 C:\Users\user\AppData\Local\...\winsound.pyd, PE32+ 51->118 dropped 120 C:\Users\user\AppData\...\vcruntime140_1.dll, PE32+ 51->120 dropped 122 C:\Users\user\AppData\...\vcruntime140.dll, PE32+ 51->122 dropped 124 28 other files (none is malicious) 51->124 dropped 188 Uses WMIC command to query system information (often done to detect virtual machines) 54->188 72 powershell.exe 54->72         started        74 WMIC.exe 54->74         started        76 reg.exe 54->76         started        82 4 other processes 54->82 190 Found suspicious powershell code related to unpacking or dynamic code loading 56->190 144 dualstack.python.map.fastly.net 151.101.192.223, 443, 49711 FASTLY-FastlyIncUS Canada 62->144 146 127.0.0.1 unknown unknown 62->146 78 powershell.exe 7 62->78         started        80 powershell.exe 7 62->80         started        file13 signatures14 process15 dnsIp16 132 mainnet.gateway.tenderly.co 35.227.193.242, 443, 49716, 49722 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 65->132 134 0xrpc.io 146.19.24.104, 443, 49713, 49717 MEVSPACEPL Poland 65->134 136 7 other IPs or domains 65->136 116 C:\Users\user\...\MicrosoftEdgeUpdate.cmd, DOS 65->116 dropped 162 Suspicious powershell command line found 65->162 164 Uses schtasks.exe or at.exe to add and modify task schedules 65->164 166 Uses WMIC command to query system information (often done to detect virtual machines) 65->166 84 schtasks.exe 65->84         started        86 powershell.exe 65->86         started        88 WMIC.exe 65->88         started        98 5 other processes 65->98 168 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 70->168 170 Found suspicious powershell code related to unpacking or dynamic code loading 70->170 90 conhost.exe 72->90         started        92 conhost.exe 74->92         started        94 conhost.exe 76->94         started        96 conhost.exe 82->96         started        100 3 other processes 82->100 file17 signatures18 process19 process20 102 conhost.exe 84->102         started        104 conhost.exe 86->104         started        106 conhost.exe 88->106         started        108 conhost.exe 98->108         started        110 conhost.exe 98->110         started        112 conhost.exe 98->112         started        114 2 other processes 98->114
Score:
10%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0
Verdict:
Malware
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:MSZIP COM Behavior Trace DeObfuscated Obfuscated Office Document PowerShell T1027 T1059 T1059.001 T1059.005 VBScript WScript.Shell
Link:
https://app.malva.re/file/4118241b2cf74cc793e75e205a4aaa8f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3wl6mcyht2oqhdh2e6r7cix4gflowqusgi2h2dcr5jc2rjrfpqa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261029-xaprassw9r/
Behaviour
Checks SCSI registry key(s)
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
cURL User-Agent
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Windows directory
Queries registry keys for unique system GUIDs
Executes a VBScript file via the Windows Script Host.
Enumerates connected drives
Checks computer location settings
Creates a file in the Startup directory
Executes dropped EXE
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/95985/
  
URLhaus
https://urlhaus.abuse.ch/url/4046829/
  
Delivery method
Distributed via web download

Comments