🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c741006e8d1c2f09e35fc4d71590aa21b5fbe7fe2b90cd9a701ae855b2745918. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c741006e8d1c2f09e35fc4d71590aa21b5fbe7fe2b90cd9a701ae855b2745918
SHA3-384 hash: ccf7577fe9a1d5780944ad64a63e9e2d19bc464befe5fa2888c1ee21e3e5710f708f8ad8ff7e4cb642eecf2ffdc51964
SHA1 hash: edb34a52f6446a81fe3bee30ecf7c52b61be05c3
MD5 hash: 3bb452d6a5b45043a985c6bd8671b704
humanhash: hotel-october-robin-friend
File name:setup.msi
Download: download sample
File size:5'611'520 bytes
First seen:2026-11-04 10:23:47 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:lXffKpIolZpS+IYaJAgGeuvKnVx9h6LZZGTQTIXmVuSxpT:9ffKpLZ9aJae6KnxoZOQkmVLp
TLSH T1454633097867F73AD095097A2AAD31ED1E4D9D115CC2CB90D9EABA6E03F71C0CAD02F4
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter smica83
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0f571467-4c73-4f00-878c-c4379f6014aa/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97156/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aeb07d33970fcef1e4b00c4
Tags:
ordin sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Searching for synchronization primitives
Creating a file in the Windows subdirectories
Creating a file
Running batch commands
Creating a process from a recently created file
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Sending a custom TCP request
Possible injection to a system process
Unauthorized injection to a recently created process
Verdict:
Unknown
Threat level:
  10/10
Confidence:
100%
Tags:
installer
Link:
https://www.filescan.io/uploads/6aeb09206833e3cff38c8c56/reports/a4d113c6-36bd-40dd-9acb-87cf553c36c9/overview
Verdict:
Malicious
Labled as:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/c741006e8d1c2f09e35fc4d71590aa21b5fbe7fe2b90cd9a701ae855b2745918
Verdict:
Unknown
File Type:
msi
First seen:
2026-10-27T21:44:00Z UTC
Last seen:
2026-11-04T09:16:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c741006e8d1c2f09e35fc4d71590aa21b5fbe7fe2b90cd9a701ae855b2745918/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.adwa.expl.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1998059
Signature
AI detected malicious Powershell script
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Detected CypherIt Packer
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Found suspicious ZIP file
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Powershell drops PE file
Self deletion via cmd or bat file
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious Ping/Del Command Combination
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1998059 Sample: setup.msi Startdate: 04/11/2026 Architecture: WINDOWS Score: 88 134 beers.ath.cx 2->134 136 aka.ms 2->136 160 Malicious sample detected (through community Yara rule) 2->160 162 Antivirus detection for dropped file 2->162 164 Multi AV Scanner detection for dropped file 2->164 166 13 other signatures 2->166 14 msiexec.exe 78 38 2->14         started        17 msiexec.exe 3 2->17         started        19 svchost.exe 2->19         started        signatures3 process4 file5 112 C:\Users\user\AppData\Local\...\repack.exe, PE32 14->112 dropped 114 C:\Users\user\AppData\Local\...\launcher.exe, PE32 14->114 dropped 116 C:\Users\user\AppData\Local\...\script.bat, DOS 14->116 dropped 118 C:\ProgramData\THC-Repack.png, JPEG 14->118 dropped 21 launcher.exe 4 14->21         started        25 cmd.exe 1 14->25         started        process6 file7 100 C:\Users\user\Desktop\repack.exe, PE32 21->100 dropped 170 Self deletion via cmd or bat file 21->170 27 repack.exe 2 21->27         started        30 cmd.exe 1 21->30         started        33 cmd.exe 1 21->33         started        172 Suspicious powershell command line found 25->172 174 Wscript starts Powershell (via cmd or directly) 25->174 176 Uses ping.exe to sleep 25->176 178 3 other signatures 25->178 35 conhost.exe 25->35         started        signatures8 process9 file10 110 C:\Users\user\AppData\Local\...\repack.tmp, PE32 27->110 dropped 37 repack.tmp 27 74 27->37         started        194 Suspicious powershell command line found 30->194 196 Wscript starts Powershell (via cmd or directly) 30->196 41 powershell.exe 8 12 30->41         started        44 conhost.exe 30->44         started        198 Uses ping.exe to sleep 33->198 46 PING.EXE 1 33->46         started        48 conhost.exe 33->48         started        signatures11 process12 dnsIp13 138 aka.ms 184.29.31.250, 443, 49710 AKAMAI-AS-AkamaiTechnologiesIncUS United States 37->138 102 C:\Users\user\AppData\Local\...\xma_dec.exe, PE32+ 37->102 dropped 104 C:\Users\user\AppData\Local\...\wintb.dll, PE32 37->104 dropped 106 C:\Users\user\AppData\...\vc_redist.x86.exe, PE32 37->106 dropped 108 44 other malicious files 37->108 dropped 50 cmd.exe 37->50         started        52 unins000.exe 37->52         started        55 cmd.exe 37->55         started        60 3 other processes 37->60 188 Obfuscated command line found 41->188 190 Found suspicious powershell code related to unpacking or dynamic code loading 41->190 192 Powershell drops PE file 41->192 58 cmd.exe 41->58         started        140 127.0.0.1 unknown unknown 46->140 file14 signatures15 process16 dnsIp17 63 hosts.exe 50->63         started        76 14 other processes 50->76 96 C:\Users\user\AppData\Local\...\_iu14D2N.tmp, PE32 52->96 dropped 67 _iu14D2N.tmp 52->67         started        180 Detected CypherIt Packer 55->180 78 2 other processes 55->78 182 Suspicious powershell command line found 58->182 184 Wscript starts Powershell (via cmd or directly) 58->184 186 Encrypted powershell cmdline option found 58->186 69 wscript.exe 58->69         started        71 powershell.exe 58->71         started        80 4 other processes 58->80 148 192.168.2.8, 138, 443, 49174 unknown unknown 60->148 73 chrome.exe 60->73         started        82 2 other processes 60->82 file18 signatures19 process20 dnsIp21 120 C:\Windows\System32\drivers\etc\hosts, ASCII 63->120 dropped 150 Modifies the hosts file 63->150 122 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 67->122 dropped 124 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 67->124 dropped 152 Wscript starts Powershell (via cmd or directly) 69->152 154 Windows Scripting host queries suspicious COM object (likely to drop second stage) 69->154 156 Suspicious execution chain found 69->156 158 WScript reads language and country specific registry keys (likely country aware script) 69->158 84 powershell.exe 69->84         started        126 C:\ProgramData\handlerex.vbs, ASCII 71->126 dropped 128 C:\ProgramData\handlerex-installer.ps1, ASCII 71->128 dropped 142 i4.imageban.ru 37.230.117.113, 443, 49738, 49739 RU-JSCIOTRU Russia 73->142 144 i7.imageban.ru 62.109.19.95, 443, 49737, 49781 RU-JSCIOTRU Russia 73->144 146 34 other IPs or domains 73->146 130 Chrome Cache Entry: 626, PDP-11 73->130 dropped 132 C:\ProgramData\handlerex_656497569.zip, Zip 80->132 dropped file22 signatures23 process24 file25 98 C:\ProgramData\handlerex.exe, PE32 84->98 dropped 168 Obfuscated command line found 84->168 88 powershell.exe 84->88         started        90 conhost.exe 84->90         started        signatures26 process27 process28 92 conhost.exe 88->92         started        94 WmiPrvSE.exe 88->94         started       
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/c741006e8d1c2f09e35fc4d71590aa21b5fbe7fe2b90cd9a701ae855b2745918
Verdict:
Malware
YARA:
4 match(es)
Tags:
.Net CAB:COMPRESSION:MSZIP DeObfuscated Executable Managed .NET Office Document PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) PowerShell SOS: 0.45 T1027 T1059.001
Link:
https://app.malva.re/file/3bb452d6a5b45043a985c6bd8671b704
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c741006e8d1c2f09e35fc4d71590aa21b5fbe7fe2b90cd9a701ae855b2745918/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y5aqa3undqxqty27ytlrlefkeg27xz76foim3gtqdluflmtulema._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution installer persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261104-mfgmrsvw7j/
Behaviour
Uses Volume Shadow Copy service COM API
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
Runs ping.exe
Modifies registry class
Enumerates system info in registry
Checks processor information in registry
Checks SCSI registry key(s)
Inno Setup is an open-source installation builder for Windows applications.
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
System Time Discovery
Executes a command shell one-liner
Event Triggered Execution: Installer Packages
Enumerates physical storage devices
Browser Information Discovery
Drops file in Windows directory
Executes a VBScript file via the Windows Script Host.
Enumerates connected drives
Checks installed software on the system
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Drops file in Drivers directory
Downloads MZ/PE file
Command and Scripting Interpreter: PowerShell
Malware Family:
n/a
Verdict:
Malicious
Tags:
loader evasion
YARA:
n/a
Link:
https://app.threat.zone/submission/756c06e1-951f-46a0-aa5c-35da72c753b1
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/97156/

Comments