MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DeerStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f
SHA3-384 hash: 3ccc73b3d2fe42d89efc541c1143f20053be552df5dca492eca456c2d910b8e38659b0aa4d3878281c52be9be5b9aac3
SHA1 hash: f205139e4ddcd252e49876b3d1c044c6642a9001
MD5 hash: 566ed2b1d948f1648adc8fa29cd889f9
humanhash: happy-diet-rugby-ack
File name:Installer.msi
Download: download sample
Signature DeerStealer
Create hunting rule
File size:8'925'184 bytes
First seen:2026-03-31 21:15:41 UTC
Last seen:2026-04-01 08:19:56 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:PqEJJDy7uNbyvYx2M6yV2ADOb+OqcSGncI:FJmybfDPzFcJ
Threatray 7 similar samples on MalwareBazaar
TLSH T191963335FC81993DF01724FA45871C03761EFC0123B8C6BFADA5FB19AAB66E409A251D
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter smica83
Tags:DeerStealer HUN msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
62
Origin country :
HU HU
Vendor Threat Intelligence
Gathering data
Gathering data
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69cc39a03a18a6e1ddf027d4
Tags:
shellcode virus hype
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug fingerprint installer keylogger packed wix
Link:
https://www.filescan.io/uploads/69cc399de2df9aa488c09fb4/reports/34722682-7bd6-4342-bed0-7ab2e22d4f4a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f
Result
Verdict:
SUSPICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
File Type:
Link:
https://opentip.kaspersky.com/c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f/results?tab=lookup
Result
Threat name:
HijackLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1891717
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Drops PE files to the user root directory
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Sample is not signed and drops a device driver
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected HijackLoader
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1891717 Sample: Installer.msi Startdate: 31/03/2026 Architecture: WINDOWS Score: 100 82 oswegohowlinzephyr.com 2->82 84 mulcaireldritchnaileir.com 2->84 86 cdn.discordapp.com 2->86 102 Suricata IDS alerts for network traffic 2->102 104 Found malware configuration 2->104 106 Malicious sample detected (through community Yara rule) 2->106 108 3 other signatures 2->108 11 msiexec.exe 163 75 2->11         started        15 msiexec.exe 3 2->15         started        signatures3 process4 file5 74 C:\Users\user\AppData\...\vcruntime140_1.dll, PE32+ 11->74 dropped 76 C:\Users\user\AppData\Local\...\sciter-x.dll, PE32+ 11->76 dropped 78 C:\Users\user\AppData\...\VCRUNTIME140.dll, PE32+ 11->78 dropped 80 11 other malicious files 11->80 dropped 120 Sample is not signed and drops a device driver 11->120 17 M_Framework.exe 9 11->17         started        21 M_Framework.exe 9 11->21         started        signatures6 process7 file8 46 C:\ProgramData\...\vcruntime140_1.dll, PE32+ 17->46 dropped 48 C:\ProgramData\...\sciter-x.dll, PE32+ 17->48 dropped 50 C:\ProgramData\...\M_Framework.exe, PE32+ 17->50 dropped 58 4 other files (1 malicious) 17->58 dropped 100 Sample is not signed and drops a device driver 17->100 23 M_Framework.exe 7 17->23         started        52 C:\ProgramData\adv_tool\vcruntime140_1.dll, PE32+ 21->52 dropped 54 C:\ProgramData\adv_tool\sciter-x.dll, PE32+ 21->54 dropped 56 C:\ProgramData\adv_tool\VCRUNTIME140.dll, PE32+ 21->56 dropped 60 4 other malicious files 21->60 dropped 27 M_Framework.exe 7 21->27         started        signatures9 process10 file11 62 C:\Users\user\AppData\...\VSLauncher.exe, PE32 23->62 dropped 64 C:\Users\user\AppData\Local\TurboD.exe, PE32+ 23->64 dropped 66 C:\Users\user\AppData\Local\...\5C974EA.tmp, PE32+ 23->66 dropped 110 Modifies the context of a thread in another process (thread injection) 23->110 112 Found hidden mapped module (file has been removed from disk) 23->112 114 Maps a DLL or memory area into another process 23->114 29 TurboD.exe 8 23->29         started        33 VSLauncher.exe 23->33         started        68 C:\Users\user\AxiCollector.exe, PE32+ 27->68 dropped 70 C:\Users\user\AppData\...\VSLauncher.exe, PE32 27->70 dropped 72 C:\Users\user\AppData\Local\...\3C4A13F.tmp, PE32+ 27->72 dropped 116 Drops PE files to the user root directory 27->116 118 Switches to a custom stack to bypass stack traces 27->118 35 VSLauncher.exe 1 27->35         started        37 AxiCollector.exe 5 2 27->37         started        signatures12 process13 dnsIp14 94 mulcaireldritchnaileir.com 172.67.162.86, 443, 49731, 49732 CLOUDFLARENETUS United States 29->94 122 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 29->122 124 Tries to harvest and steal browser information (history, passwords, etc) 29->124 126 Writes to foreign memory regions 29->126 134 3 other signatures 29->134 39 chrome.exe 29->39         started        128 Unusual module load detection (module proxying) 35->128 130 Switches to a custom stack to bypass stack traces 35->130 132 Found direct / indirect Syscall (likely to bypass EDR) 35->132 96 oswegohowlinzephyr.com 104.21.22.143, 49727, 80 CLOUDFLARENETUS United States 37->96 98 cdn.discordapp.com 162.159.133.233, 443, 49730 CLOUDFLARENETUS United States 37->98 41 msiexec.exe 3 37->41         started        signatures15 process16 process17 43 chrome.exe 39->43         started        dnsIp18 88 ogads-pa.clients6.google.com 142.250.217.10, 443, 49747, 49748 GOOGLEUS United States 43->88 90 www.google.com 142.251.156.119, 443, 49740, 49741 GOOGLEUS United States 43->90 92 play.google.com 142.251.211.206, 443, 49749, 49750 GOOGLEUS United States 43->92
Score:
4%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f/
Verdict:
Malicious
Threat:
Family.HIJACKLOADER
Link:
https://tip.neiki.dev/file/c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y3nhuyc7ovcdcuju3up4v6c57mkwkk4yvynuldvqcog5tdepnopq._file
Verdict:
malicious
Label(s):
deerstealer
Create hunting rule
hijackloader
Create hunting rule
Similar samples:
643fe4bf793c941d42c14c59d85fa033381652fafbd4122792c04cc0316c2d68
DeerStealer
7dfe8d25b80b42ba7834c671f91956652ba929a239056bfc4321622eab60de3e
DeerStealer
810a793a997d62829d45fc8c28c6808b9303256c2e4a635af39e7e142b4e0c79
DeerStealer
error
DeerStealer
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:deerstealer family:hijackloader loader persistence privilege_escalation ransomware stealer
Link:
https://tria.ge/reports/260331-z4js9aet8p/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
DeerStealer
Deerstealer family
Detects DeerStealer
Detects HijackLoader (aka IDAT Loader)
HijackLoader, IDAT loader, Ghostulse,
Hijackloader family
Malware family:
GHOSTPULSE
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c6da7a605f75/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Windows_Trojan_GhostPulse_caea316b
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

DeerStealer

Microsoft Software Installer (MSI) msi c6da7a605f7544315134dd1fcaf85dfb15652b98ae1b458eb0138dd98c8f6b9f

(this sample)

HijackLoader

Microsoft Software Installer (MSI) msi ace23351634f9b816b0c7aeacedaa41fc0e8d1bdd7b98ca4830782453ff34b3c

Cape
Cape
https://www.capesandbox.com/analysis/59963/
  
Dropping
SHA256 ace23351634f9b816b0c7aeacedaa41fc0e8d1bdd7b98ca4830782453ff34b3c
  
Dropping
MD5 68fab3883cc29fbaaad774f3c5a32bf5

Comments