🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac4e8acc2086f745b274ee623dd109cf76dabc51f26e758e069a23f9e3c671a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac4e8acc2086f745b274ee623dd109cf76dabc51f26e758e069a23f9e3c671a4
SHA3-384 hash: d9d998e0a763d3d035ee855c68fd541a423e5f9592c6d92da09c7625bea074eb52677189de39c856e907059169a3f9a8
SHA1 hash: d3e096fa83fdbcfe4b5a29f45cf3e0eb635e2ce4
MD5 hash: 88c4c70a1e2896f7c4b378bb25f607ae
humanhash: pizza-hydrogen-chicken-queen
File name:ac4e8acc2086f745b274ee623dd109cf76dabc51f26e758e069a23f9e3c671a4
Download: download sample
File size:28'533'760 bytes
First seen:2026-09-16 18:55:44 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 786432:88+kFjTmEfzC10uri5N2tlZLToAb0ABPnBejA0R0IKk1L:89kFjPrC10ubHBOjA0R0QL
TLSH T189573336A387C532D59C427BE954FE0E0479FE63473011E7B6E9796A88B0CC1A3B4792
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter johnk3r
Tags:banker Mekotio msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
BR BR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ad73de41-41bf-4430-a736-e3badb3b3d2c/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/85985/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 cmd crypto expired-cert fingerprint lolbin reconnaissance short-lived-cert wix
Link:
https://www.filescan.io/uploads/6aaae6c8c4455c5a67a09c89/reports/3772a3aa-330c-490d-9a15-2e0524c55504/overview
Verdict:
Malicious
Labled as:
Malware.Generic
Link:
https://www.hybrid-analysis.com/sample/ac4e8acc2086f745b274ee623dd109cf76dabc51f26e758e069a23f9e3c671a4
Verdict:
Malicious
File Type:
msi
First seen:
2026-09-12T21:56:00Z UTC
Last seen:
2026-09-12T22:05:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ac4e8acc2086f745b274ee623dd109cf76dabc51f26e758e069a23f9e3c671a4/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1973941
Signature
Connects to a pastebin service (likely for C&C)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with function prologues
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Switches to a custom stack to bypass stack traces
Tries to evade analysis by execution special instruction (VM detection)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1973941 Sample: wdG1vxcmmp.msi Startdate: 16/09/2026 Architecture: WINDOWS Score: 88 37 pastebin.com 2->37 43 Multi AV Scanner detection for dropped file 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 PE file contains section with special chars 2->47 51 3 other signatures 2->51 7 msiexec.exe 16 42 2->7         started        10 temp.exe 2->10         started        13 temp.exe 2->13         started        15 msiexec.exe 2 2->15         started        signatures3 49 Connects to a pastebin service (likely for C&C) 37->49 process4 file5 23 C:\Windows\Installer\MSI2CE5.tmp, PE32 7->23 dropped 25 C:\Windows\Installer\MSI2C48.tmp, PE32 7->25 dropped 27 C:\Windows\Installer\MSI2BF9.tmp, PE32 7->27 dropped 29 4 other malicious files 7->29 dropped 17 temp.exe 3 3 7->17         started        21 msiexec.exe 7->21         started        53 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->53 55 Overwrites code with function prologues 10->55 57 Hides threads from debuggers 10->57 signatures6 process7 dnsIp8 31 52.159.123.0, 80 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 17->31 33 pastebin.com 172.66.171.73, 443, 49713 CLOUDFLARENET-CloudflareIncUS Canada 17->33 35 89.213.142.39, 6453 AS-VULTR-TheConstantCompanyLLCUS United Kingdom 17->35 39 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 17->39 41 Hides threads from debuggers 17->41 signatures9
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/ac4e8acc2086f745b274ee623dd109cf76dabc51f26e758e069a23f9e3c671a4
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
CAB:COMPRESSION:MSZIP Executable Office Document PDB Path PE (Portable Executable) PE File Layout SVG T1059.007
Link:
https://app.malva.re/file/88c4c70a1e2896f7c4b378bb25f607ae
Gathering data
Threat name:
Win32.Trojan.Suschil
Create hunting rule
Status:
Malicious
First seen:
2026-09-16 18:56:21 UTC
File Type:
Binary (Archive)
Extracted files:
74
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vrhivtbaq33ulmtu5zrd3uijz53nvpcr6jxhldqgtir7ty6gogsa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/260916-xlfb1aep6w/
Behaviour
NTFS ADS
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ac4e8acc2086f745b274ee623dd109cf76dabc51f26e758e069a23f9e3c671a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_MSI_LATAM_Banker_From_LatAm
Create hunting rule
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/85985/

Comments