MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de338abc4bb273357fd85722a8436bc1e9b6e68e1391ec1180d09571d689580b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	de338abc4bb273357fd85722a8436bc1e9b6e68e1391ec1180d09571d689580b
SHA3-384 hash:	65737315a8af96b8dacab8a5e677e5f8043dd3ee5fd94332e3f37c8bbd90138bca93f393ca66f6b392a0b6bd2047c418
SHA1 hash:	90ab0bde8caf262562297e2affed9504910cfd46
MD5 hash:	0e56a77dcac8b489fe0d5a20e1285139
humanhash:	indigo-moon-fix-red
File name:	CrimsonMods.msi
Download:	download sample
File size:	19'836'928 bytes
First seen:	2026-09-25 20:33:53 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	393216:J3RAaps4aDk2rkKX5rLXpvNGNtFu27aflpD3CNV4a8dxgvbGDi89+PzBGv:JhAaRmIKJfXpENtDatpDSoa84vb5Pz
TLSH	T16E1733926C362C83CA6435BB23476365AF305DB03B128B942D35F86E1CFE1FA1A59747
TrID	53.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 39.2% (.MSP) Windows Installer Patch (44509/10/5) 7.0% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	AmadeyHunter
Tags:	msi signed

Code Signing Certificate

Organisation:	Download Manager
Issuer:	Download Manager
Algorithm:	sha384WithRSAEncryption
Valid from:	2026-09-24T19:08:43Z
Valid to:	2031-09-24T19:18:43Z
Serial number:	546920a47580f481417b40035873d213
Thumbprint Algorithm:	SHA256
Thumbprint:	145a33b94b41862306bb600a07e0f6f564468f965f4b10d5c1bde47cb56e4b9e
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

AmadeyHunter

Can be found hosted at https://www.mediafire.com/file_premium/krd5eej1cse8u89/CrimsonMods.zip/file
Can be found by browsing the referenced links below...
Notice: If it's been awhile, by now the domains might be known as malicious or taken down/offline, this excludes mediafire.com...

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/6160aece-31d5-4fe8-9a38-1eaf14aa29a6/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/89048/

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ace2147853d431abd4e0acc

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug CAB expired-cert installer installer reconnaissance signed

Link:

https://www.filescan.io/uploads/6ab6dacb5e0b9b10a637ac72/reports/078d8655-1a74-4dbe-8bdd-1f2721eafb69/overview

Verdict:

Suspicious

Labled as:

Adware.U.InstallCore.vl

Link:

https://www.hybrid-analysis.com/sample/de338abc4bb273357fd85722a8436bc1e9b6e68e1391ec1180d09571d689580b

Verdict:

Unknown

File Type:

msi

Link:

https://opentip.kaspersky.com/de338abc4bb273357fd85722a8436bc1e9b6e68e1391ec1180d09571d689580b/results?tab=lookup

Score:

91%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260925-zch3msw14q/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Badlisted process makes network request

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/de338abc4bb273357fd85722a8436bc1e9b6e68e1391ec1180d09571d689580b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_SliverFox_String Create hunting rule
Author:	huoji
Description:	Detect files is `SliverFox` malware

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Link

https://crimsonmods[dot]co/

Link

https://crimsonmods[dot]biz/

Cape

https://www.capesandbox.com/analysis/89048/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample