MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdf433cc71691769012cdfb80c1df31bc31ae63a0b30bc2a94feb506d2afd83d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SyncroRMM


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cdf433cc71691769012cdfb80c1df31bc31ae63a0b30bc2a94feb506d2afd83d
SHA3-384 hash: 695cf81e69ef450fe4a873ddf27f13478ab992694d0041091eec414bbe1f9c20b11edd8e00994a34ae0d48e8edfcf49a
SHA1 hash: 906449526f356d38106e823483e34a7e8351c4e9
MD5 hash: faae74a5121aad7f1a25fccc4d07e2a1
humanhash: nuts-princess-oscar-failed
File name:DH9338297YV389821.msi
Download: download sample
Signature SyncroRMM
Create hunting rule
File size:6'682'112 bytes
First seen:2026-01-13 10:01:42 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:REx4kBtzkqeUc0WF8RBS5F6xYmQHRi0Q7zO1wKfLR9I7rwn:REqkB44BS5sxiRi521lfLReU
TLSH T142663385F4C05A3EF19ECD750CBAB628041B62135B204ADBF34B0955EE21FE249FE6D9
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter abuse_ch
Tags:fake-DHL msi rmm signed SyncroRMM

Code Signing Certificate

Organisation:Servably Inc.
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2024-05-06T00:00:00Z
Valid to:2027-05-05T23:59:59Z
Serial number: 0dfad4ca18767f45b3c9fc7565395709
Intelligence: 36 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 456e86fa9b5113d50debcfd1b8d0d53642e72522351c5f9b1a975caaf4391cd6
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
MSI Syncro
Details
MSI
an embedded setup program or component
Syncro
an API key, customer ID, and folder ID
Link:
https://research.acce.ciphertechsolutions.com/results/8649a97f-5890-4f93-984a-d5ea6638c7a0/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/48768/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6966183857243ef151ccd88e
Tags:
shellcode emotet virus
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 CAB installer lolbin packed reconnaissance rundll32 signed wix
Link:
https://www.filescan.io/uploads/6966183260d1ef876ded87f8/reports/0e1111bf-dd31-42cd-9190-65a2818ce1c3/overview
Verdict:
Suspicious
Labled as:
Application.Generic
Link:
https://www.hybrid-analysis.com/sample/cdf433cc71691769012cdfb80c1df31bc31ae63a0b30bc2a94feb506d2afd83d
Verdict:
Adware
File Type:
msi
First seen:
2026-01-13T08:15:00Z UTC
Last seen:
2026-01-13T12:26:00Z UTC
Hits:
~10
Detections:
not-a-virus:BSS:WebToolbar.Win32.MultiPlug.ab not-a-virus:HEUR:RemoteAdmin.OLE2.Syncro.gen not-a-virus:HEUR:RemoteAdmin.MSIL.Syncro.gen
Link:
https://opentip.kaspersky.com/cdf433cc71691769012cdfb80c1df31bc31ae63a0b30bc2a94feb506d2afd83d/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1849756
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Creates files in the system32 config directory
Installs Task Scheduler Managed Wrapper
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Reads the Security eventlog
Reads the System eventlog
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1849756 Sample: DH9338297YV389821.msi Startdate: 13/01/2026 Architecture: WINDOWS Score: 100 108 usit-services.syncroapi.com 2->108 110 traversal.syncromsp.com 2->110 112 6 other IPs or domains 2->112 120 Multi AV Scanner detection for submitted file 2->120 122 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 2->122 124 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 2->124 126 6 other signatures 2->126 10 Syncro.Overmind.Service.exe 2->10         started        14 msiexec.exe 79 31 2->14         started        16 Syncro.Service.Runner.exe 2->16         started        19 10 other processes 2->19 signatures3 process4 dnsIp5 82 C:\Program Files\...\Syncro.Service.exe, PE32 10->82 dropped 84 C:\...\Microsoft.Win32.TaskScheduler.dll, PE32 10->84 dropped 86 C:\...\SyncroLive.Service.Runner.exe, PE32 10->86 dropped 96 227 other files (1 malicious) 10->96 dropped 138 Installs Task Scheduler Managed Wrapper 10->138 140 Reads the Security eventlog 10->140 142 Reads the System eventlog 10->142 88 C:\Users\user\AppData\Local\...\Installer.exe, PE32 14->88 dropped 90 C:\Windows\Installer\MSI3A3D.tmp, PE32 14->90 dropped 21 Installer.exe 8 14->21         started        24 msiexec.exe 14->24         started        98 ld.aurelius.host 172.212.39.181, 443, 49744, 49772 IFX18747US United States 16->98 100 usit-services.syncroapi.com 104.26.14.34, 443, 49736, 49737 CLOUDFLARENETUS United States 16->100 102 realtime.kabutoservices.com 48.223.187.12, 443, 49742, 49746 ATGS-MMD-ASUS United States 16->102 92 C:\...\Syncro.Overmind.Service.exe, PE32 16->92 dropped 94 C:\ProgramData\Syncro\bin\FilePusher.exe, PE32 16->94 dropped 144 Creates files in the system32 config directory 16->144 26 Syncro.Overmind.Service.exe 16->26         started        29 Syncro.App.Runner.exe 16->29         started        31 Syncro.App.Runner.exe 16->31         started        104 127.0.0.1 unknown unknown 19->104 146 Changes security center settings (notifications, updates, antivirus, firewall) 19->146 33 SyncroLive.Agent.Runner.exe 19->33         started        36 MpCmdRun.exe 19->36         started        38 Syncro.App.Runner.exe 19->38         started        file6 signatures7 process8 dnsIp9 64 C:\Users\user\...\Syncro.Installer.exe, PE32 21->64 dropped 40 Syncro.Installer.exe 46 158 21->40         started        45 rundll32.exe 31 24->45         started        132 Creates files in the system32 config directory 26->132 47 conhost.exe 26->47         started        106 traversal.syncromsp.com 34.193.230.118, 443, 49760 AMAZON-AESUS United States 33->106 49 conhost.exe 33->49         started        51 conhost.exe 36->51         started        file10 signatures11 process12 dnsIp13 114 rmm.syncromsp.com 20.242.180.219, 443, 49723, 49731 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 40->114 116 admin.syncroapi.com 104.26.15.34, 443, 49730 CLOUDFLARENETUS United States 40->116 118 proxybox-lb-250966913.us-east-1.elb.amazonaws.com 3.226.15.155, 443, 49724, 49743 AMAZON-AESUS United States 40->118 66 C:\Program Files\...\Syncro.Service.exe, PE32 40->66 dropped 68 C:\...\Microsoft.Win32.TaskScheduler.dll, PE32 40->68 dropped 70 C:\...\Syncro.Service.Runner.exe, PE32 40->70 dropped 78 113 other files (none is malicious) 40->78 dropped 134 Installs Task Scheduler Managed Wrapper 40->134 136 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 40->136 53 cmd.exe 40->53         started        72 C:\...\WixToolset.Dtf.WindowsInstaller.dll, PE32 45->72 dropped 74 C:\Windows\...\WiX.CustomActions.dll, PE32 45->74 dropped 76 C:\Windows\Installer\...\UrlCombineLib.dll, PE32 45->76 dropped 80 24 other files (none is malicious) 45->80 dropped file14 signatures15 process16 process17 55 InstallUtil.exe 53->55         started        58 conhost.exe 53->58         started        60 sc.exe 53->60         started        62 sc.exe 53->62         started        signatures18 128 Reads the Security eventlog 55->128 130 Reads the System eventlog 55->130
Score:
30%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/cdf433cc71691769012cdfb80c1df31bc31ae63a0b30bc2a94feb506d2afd83d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cdf433cc71691769012cdfb80c1df31bc31ae63a0b30bc2a94feb506d2afd83d/
Verdict:
Malicious
Threat:
Family.SYNCRORMM
Link:
https://tip.neiki.dev/file/cdf433cc71691769012cdfb80c1df31bc31ae63a0b30bc2a94feb506d2afd83d
Threat name:
Win32.Trojan.Suschil
Create hunting rule
Status:
Malicious
First seen:
2026-01-12 08:43:49 UTC
File Type:
Binary (Archive)
Extracted files:
96
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zx2dhtdrnelwsajm364ayhptdpbrvzr2bmylykuu722qnuvp3a6q._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor bootkit discovery execution persistence privilege_escalation ransomware rat
Link:
https://tria.ge/reports/260113-l21gbsaw4g/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Checks installed software on the system
Drops file in Program Files directory
Drops file in Windows directory
Executes dropped EXE
Launches sc.exe
Loads dropped DLL
Boot or Logon Autostart Execution: Authentication Package
Drops file in System32 directory
Event Triggered Execution: Component Object Model Hijacking
Downloads MZ/PE file
Enumerates connected drives
Writes to the Master Boot Record (MBR)
ConnectWise ScreenConnect remote access tool
Badlisted process makes network request
Sets service image path in registry
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e72ff4a7-62c8-49c7-98ef-239f073be364
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cdf433cc71691769012cdfb80c1df31bc31ae63a0b30bc2a94feb506d2afd83d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:WIN_WebSocket_Base64_C2_20250726
Create hunting rule
Author:dogsafetyforeverone
Description:Detects configuration strings used by malware to specify WebSocket command-and-control endpoints inside Base64-encoded data. It looks for prefixes such as '#ws://' or '#wss://' that were found in QuasarRAT configuration data.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SyncroRMM

Microsoft Software Installer (MSI) msi cdf433cc71691769012cdfb80c1df31bc31ae63a0b30bc2a94feb506d2afd83d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3757130/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/48768/

Comments