MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973
SHA3-384 hash: bbc8360459d705caeb933883a05e4cc96b1421f1ad4fb49855193a21c9253f320d4428a2b69d67b027fd536901301dd4
SHA1 hash: 47b4000d52a36d1a30e99c2a5f6f6a818ac86e46
MD5 hash: 0d0819b86f0c3777d00c5fe1ebf14f4b
humanhash: yellow-foxtrot-stairway-alaska
File name:Google_Install.exe
Download: download sample
File size:12'652'343 bytes
First seen:2025-12-31 23:57:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5e48fbae3520a62c95e412b293e1759c (2 x ValleyRAT, 1 x PureLogsStealer)
ssdeep 393216:1CIwNDgam15QA0gFXqF3zNsRzohWgMyR5u7Uo8ufh:1CIwWvWgBqnvhAyLo98uZ
TLSH T160D6336BA681E496FA141AFE784D131CC27FFC77760B5E03A7806A3DD795221399B00B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon e8b249cd4dc982e0 (7 x CoinMiner, 4 x VenomRAT, 4 x RustyStealer)
Reporter Ling
Tags:exe Malgent Trojan:Win32/Malgent!MSR


Avatar
CNGaoLing
This sample has been reviewed by Microsoft researchers and determined to be malware. (Trojan:Win32/Malgent!MSR)

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
IR IR
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c56b5e2b-f57d-4e0f-9089-fc5f1fc917c5/
Malware family:
n/a
ID:
1
File name:
Google_Install.exe
Verdict:
Malicious activity
Analysis date:
2025-12-31 23:58:21 UTC
Tags:
auto-reg rust
Link:
https://app.any.run/tasks/38f81e9d-cc2a-4269-b326-f2deab83aa6b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46719/
Detection(s):
Sanesecurity.Malware.28885.BadCo.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6955b898d2357cccc3de48a6
Tags:
shellcode dropper emotet virus
Verdict:
Malicious
Labled as:
Trojan.Agent.oa
Link:
https://www.hybrid-analysis.com/sample/d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-31T05:48:00Z UTC
Last seen:
2026-01-02T02:37:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Mansabo.sb Trojan.Win32.AntiAV.ddcc Backdoor.Win32.Zegost.sb PDM:Trojan.Win32.Generic Trojan.Win32.RokRat.sb Trojan.Win32.Gatak.sb Trojan.Win32.AntiAV.sb Trojan.Win32.AntiAV.ddcd Trojan-Dropper.Win32.Dapato.shri
Link:
https://opentip.kaspersky.com/d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/07af6488-076e-4c1c-b493-d430fffa2077
Score:
92%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/0d0819b86f0c3777d00c5fe1ebf14f4b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973/
Verdict:
Malicious
Threat:
Trojan.Win32.AntiAV
Link:
https://tip.neiki.dev/file/d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2gw2tqcm5rfaeltqkkfslzx462oxhg7bvwmay7wdkoszfmh6tfzq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery installer persistence privilege_escalation spyware stealer trojan
Link:
https://tria.ge/reports/260106-n5a2ysgm7v/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Inno Setup is an open-source installation builder for Windows applications.
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Checks installed software on the system
Checks whether UAC is enabled
Checks computer location settings
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Boot or Logon Autostart Execution: Active Setup
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ae63ad35-8298-41bb-be51-75c96cfbcbe0
Unpacked files
SH256 hash:
d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973
MD5 hash:
0d0819b86f0c3777d00c5fe1ebf14f4b
SHA1 hash:
47b4000d52a36d1a30e99c2a5f6f6a818ac86e46
Link:
https://www.unpac.me/results/1c0926f9-48fd-46cf-97fe-84769c8dbf92/
SH256 hash:
9e827da500a01182a8bc7f26866bdf3ecc59589719fccb64d21b59366f7f4bae
MD5 hash:
5e620077b85cb5d624b41f88730f3fca
SHA1 hash:
aedc100ff06b1bf109d6d267d372c0d61aabd9b1
Link:
https://www.unpac.me/results/1c0926f9-48fd-46cf-97fe-84769c8dbf92/
SH256 hash:
c5e93df5dee2ee741f55d0e037cd7c0a043eed833b8d624df9d375a9fc2e046e
MD5 hash:
a3335fec5078263210b1edf1cf74d6d0
SHA1 hash:
48e1523b66622328c0566a62cdde2ee174c1fa9a
Link:
https://www.unpac.me/results/1c0926f9-48fd-46cf-97fe-84769c8dbf92/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/1c0926f9-48fd-46cf-97fe-84769c8dbf92/
SH256 hash:
75227e597f5868e0e20523436c78ba28775df66248b584700044bb2109f72738
MD5 hash:
606fdf1fa001522cef6a48935400c064
SHA1 hash:
fd7fbe51b671257d6e2572e256df07ed89ea65c4
Link:
https://www.unpac.me/results/1c0926f9-48fd-46cf-97fe-84769c8dbf92/
SH256 hash:
dc7b6b556ad8229c9cb105e9bf304d550a055e814a318bc5f825eeb30cf5a81b
MD5 hash:
0c4fe24de2265841b1456305422f974f
SHA1 hash:
2cb66d3d154dea5b725025f087b41e02c5438c75
Link:
https://www.unpac.me/results/1c0926f9-48fd-46cf-97fe-84769c8dbf92/
SH256 hash:
1c55a9fd0e0e422bb20f88356acffd0f81c0decd26ae8a01019469badda4c313
MD5 hash:
f25ca96a832c7bc4d96722211a7d9ce8
SHA1 hash:
1c8f80403969aad24ff885aa971d01f0f68a233e
Link:
https://www.unpac.me/results/1c0926f9-48fd-46cf-97fe-84769c8dbf92/
SH256 hash:
35ca839dbec9ae5da553b51a1994b9a5d1a3fae67be29fa99ae77974ab11ff20
MD5 hash:
c48072d261bd453a63438da46f6cda7a
SHA1 hash:
24ff956f48435ebeedcc8833ec9bba4336d64b80
Link:
https://www.unpac.me/results/1c0926f9-48fd-46cf-97fe-84769c8dbf92/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AlternativesExample1
Create hunting rule
Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe d1ada9c04cec4a022e70528b25e6fcf69d739be1ad980c7ec353a592b0fe9973

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/46719/

Comments