MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1051b842f6ba781236e736bcb3a1ed9c10bc2036b6f9d2c43062e0bf7b25bba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HijackLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1051b842f6ba781236e736bcb3a1ed9c10bc2036b6f9d2c43062e0bf7b25bba
SHA3-384 hash: 7af30bb4bf40eddd6396c4aa2dcda8a6fb55240ca83c9e40a9a195c76d117f5ab985752893e1d7f054c56e647ee22c46
SHA1 hash: 7aca816d45a58363c2aaa85c50a0514818b9fded
MD5 hash: fe125e4c467adffd0df795c1be74969d
humanhash: arkansas-india-sad-shade
File name:RKROGNWD.msi
Download: download sample
Signature HijackLoader
Create hunting rule
File size:3'227'648 bytes
First seen:2025-09-19 07:17:15 UTC
Last seen:2025-09-19 07:22:36 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:WQY03yBG+qYHIlPLef1kzYpPoled4yNj5doEEm1++rmvVrZ5OGG5K0FlJl:W0iZIladkzYp8gNHdoHm1NrQ51zgJ
Threatray 28 similar samples on MalwareBazaar
TLSH T117E533727C987E07D082E332C0FEF660EB75AC5C4A86792328E537161536B88B5B5973
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter JAMESWT_WT
Tags:HIjackLoader maut-swiss-com msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
41
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28274/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cd0396246a2631bd30fb90
Tags:
virus spawn
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug crypto expired-cert fingerprint installer keylogger wix
Link:
https://www.filescan.io/uploads/68cd0393390649f7a5f36878/reports/5450e3aa-a0c4-4190-8b58-3526294492e9/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f1051b842f6ba781236e736bcb3a1ed9c10bc2036b6f9d2c43062e0bf7b25bba
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/f1051b842f6ba781236e736bcb3a1ed9c10bc2036b6f9d2c43062e0bf7b25bba
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
msi
First seen:
2025-09-18T08:30:00Z UTC
Last seen:
2025-09-18T08:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f1051b842f6ba781236e736bcb3a1ed9c10bc2036b6f9d2c43062e0bf7b25bba/results?tab=lookup
Score:
2%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/f1051b842f6ba781236e736bcb3a1ed9c10bc2036b6f9d2c43062e0bf7b25bba
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:LZX Executable Office Document PDB Path PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/fe125e4c467adffd0df795c1be74969d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1051b842f6ba781236e736bcb3a1ed9c10bc2036b6f9d2c43062e0bf7b25bba/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ecrxbbpnotyci3oonv4woq63haqxqqdnnxz2lcdayxax55slo5a._file
Verdict:
malicious
Label(s):
hijackloader
Create hunting rule
amadey
Create hunting rule
Similar samples:
3306b32868590d80dfbcafaba3c6cbbf3514b7b6b4297c41561cec7d769d7b0f
HijackLoader
72acf597de6ade41537a8d9d153e89064168ed780feeffc66ecf3081922fd87d
HijackLoader
7dfe8d25b80b42ba7834c671f91956652ba929a239056bfc4321622eab60de3e
HijackLoader
bcc062030c3615d3f8e42e3a2a0b4410e07cf5c845c72c95b56d41d81bac5f46
HijackLoader
e6f4d4f68abd1d5ced36d1606d16c42b63a06c5c681d4662b00fb8683bf2a418
HijackLoader
ead6b1f0add059261ac56e9453131184bc0ae2869f983b6a41a1abb167edf151
HijackLoader
error
HijackLoader
f2a068164ed7b173f17abe52ad95c53bccf3bb9966d75027d1e8960f7e0d43ac
HijackLoader
+ 18 additional samples on MalwareBazaar
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:hijackloader botnet:2addb7 discovery loader persistence privilege_escalation ransomware trojan
Link:
https://tria.ge/reports/250919-h4mrgaeq61/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Suspicious use of SetThreadContext
Enumerates connected drives
Amadey
Amadey family
Detects HijackLoader (aka IDAT Loader)
HijackLoader
Hijackloader family
Malware Config
C2 Extraction:
http://95.164.53.109
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1bf5d1d6-42d3-4b7b-9545-9ac62be2fa13
Malware family:
IDATLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f1051b842f6b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f1051b842f6ba781236e736bcb3a1ed9c10bc2036b6f9d2c43062e0bf7b25bba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/28274/

Comments