MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d680e2a0429145c94a62fd0a3c76fc7a54d74e9d72016794db4900a191457b8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	d680e2a0429145c94a62fd0a3c76fc7a54d74e9d72016794db4900a191457b8d
SHA3-384 hash:	4996d4ea16c73df044f73ecb1a2e0921cf9aab7a6e5985b54ae0e13163a9c0ee2188feb318043bfb626b24e7fbf87f93
SHA1 hash:	9b5a39569a1d2a5d97e48bf1e912e411909d9897
MD5 hash:	0cb83ff2117ad5473e1b5943b992032b
humanhash:	football-beer-spaghetti-bakerloo
File name:	formulario_agendamiento_citas.msi
Download:	download sample
File size:	2'879'488 bytes
First seen:	2025-12-06 03:07:04 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	49152:dgXfghKrnPQzjY7dX/HzPlqNQsHG5RaMX9DrCvnaccz/oU1kuAd6xUghG:G4hABX/HzPEq50o/unJcor62y
TLSH	T1A6D533A17A68536AC693F674037847C093DAFC29E53700ABD52DF68E22B43E370645AD
TrID	88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	armored
Tags:	msi remcos

armored

Distributed via WhatsApp. The attacker pretend to be real state agents or sellers. The C2 is from Colombia.

This new submissions is uncompressed and I include the Virustotal link. First seen on VT 3 days ago.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

HijackLoader MSI Remcos

Details

HijackLoader

embedded components, an injection process, and filepaths

HijackLoader

an XOR key and XOR-decrypted/LZNT1 decompressed component

MSI

an embedded setup program or component

Remcos

a version number and verbose configuration settings

Link:

https://research.acce.ciphertechsolutions.com/results/819b1a16-501b-4019-b19a-f869f7d57fbb/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/42711/

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69341dfb920336450abc017f

Tags:

shellcode

Verdict:

Malicious

File Type:

msi

First seen:

2025-12-03T13:37:00Z UTC

Last seen:

2025-12-07T21:45:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d680e2a0429145c94a62fd0a3c76fc7a54d74e9d72016794db4900a191457b8d/results?tab=lookup

Score:

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.