MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54
SHA3-384 hash: 34db23ac3c074f9e9b3f3bca74d18407a5b35d5e521a4ada1c6cf9213fc58fdaa7acd33a5eaa1e3426985a8265da4876
SHA1 hash: 68d5a2459a4a19af4e0e7f60daeb8c662f14a912
MD5 hash: ac108558ae3c869e43266664e70d20a3
humanhash: delaware-east-rugby-lamp
File name:TROLLBUSTERS.msi
Download: download sample
File size:20'361'216 bytes
First seen:2026-07-19 10:29:59 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:kncN/pyn3S3glJQv87upm4GCAKUd2Cu3et11GCaTSLiY:kU2p+06NA7dpIetOY
TLSH T1C92733A668262E83CA6026BB23531702BF310DB33B1187512D79F92D1CBD1FA5B5D35B
TrID 53.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
39.2% (.MSP) Windows Installer Patch (44509/10/5)
7.0% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter lfr
Tags:msi signed

Code Signing Certificate

Organisation:Service State Service Watch
Issuer:Service State Service Watch
Algorithm:sha512WithRSAEncryption
Valid from:2026-07-18T19:49:47Z
Valid to:2028-07-18T19:59:48Z
Serial number: 72ae3ca8df885cb940e9313e633decc2
Thumbprint Algorithm:SHA256
Thumbprint: b588e47d69ab3bc260a4b365d978f0d83d6c001a6d3dae6fa3cf3fcb499357c4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
lfr
https://dota33.itch.io/trollbusters-club

https://www.virustotal.com/gui/file/67382a59430ab53644798a8c214a87ab3f92c5d21aa02f4405b4b82ce3c200e6/detection
https://www.virustotal.com/gui/file/ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54/detection

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
FR FR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9cd2e0ac-f59c-4d73-b67f-d64944a3f743/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75187/
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5ca3f3bcffb2c48cb780a2
Tags:
infosteal shellcode shell sage
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
installer signed
Link:
https://www.filescan.io/uploads/6a5ca765daebc54704367ac4/reports/33420039-f461-4e82-87ff-4119f7072d5d/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54
Verdict:
Clean
File Type:
msi
Link:
https://opentip.kaspersky.com/ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54
Verdict:
Malware
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:MSZIP DeObfuscated Executable Office Document PDB Path PE (Portable Executable) PE File Layout PowerShell Scripting.FileSystemObject SVG T1027 T1059.001 T1059.005 WScript.Shell
Link:
https://app.malva.re/file/ac108558ae3c869e43266664e70d20a3
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2e2ro5v3qoxc3w3ylmktp7ypedoz65uy5hwh45k35mlsniytnka._file
Verdict:
malicious
Label(s):
RevStealer
Create hunting rule
Link:
https://reports.threatray.com/4b64048b-1604-4ffc-b49c-051bfbc7abee
Similar samples:
1dba90678ccc5a6f448f30b58379d0df2771acc681c3fba2f5d0a4d3ac5e07fa
64bd417c0c7a906b3231892360cf7be0e0ce79672bb893d91288476cc0c72187
ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54
cc4b2f37dfdd748e224622cf88dde7d0bfc016cb81f5b67fc9573b1431b866e8
dcc3893f89bdc55dc2f56bfccd426a7652e37b5a4e8790de99afc47bec3ecef4
ef8bb83a9be7d70ff03d653e5b8769bcb99c529b33a15874efd2d3439c63acf1
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/260719-mj7claht2q/
Behaviour
Checks SCSI registry key(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
Executes a command shell one-liner
Drops file in Windows directory
Executes a VBScript file via the Windows Script Host.
Badlisted process makes network request
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75187/

Comments