🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f156a7b27a367a54d8adedb7fd7675faab13d6d39de4f2c8c638bd049bd588d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnappyClient


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f156a7b27a367a54d8adedb7fd7675faab13d6d39de4f2c8c638bd049bd588d0
SHA3-384 hash: 5572480191993a9aba60fbdaa720d02e3c599cb8322e6ce268cd6b8eb92328e5699eacca7d03c82d064474e05208aec2
SHA1 hash: 8f13186e3542edbb346e9e29f8924e695e53456c
MD5 hash: 98d7ff70fcaa81b43ccf72317fa74f22
humanhash: spaghetti-comet-zebra-fruit
File name:zoom_sdk-3.2.msi
Download: download sample
Signature SnappyClient
Create hunting rule
File size:17'010'688 bytes
First seen:2026-11-09 20:20:59 UTC
Last seen:2026-11-09 21:17:58 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:7B9WuotSDqIXRZyehtIK/Hk4CmVoph0hzXn6VL:/HotAqIhZyehmXvQop2hz3m
TLSH T165073307BECA761FE74E51321286671C47A04C22DA627027448E79ED1476BE0F3FE9E6
TrID 83.7% (.MSI) Microsoft Windows Installer (454500/1/170)
11.2% (.MST) Windows SDK Setup Transform script (61000/1/5)
3.5% (.WPS) Kingsoft WPS Office document (alt.) (19502/3/2)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter smica83
Tags:msi SnappyClient

Intelligence

File Origin
# of uploads :
2
# of downloads :
100
Origin country :
FR FR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c25ac20c-6021-49dc-8044-286fb668e810/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/98835/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af22b47ac89c90fc65acb10
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Searching for synchronization primitives
Creating a file in the Windows subdirectories
Creating a file
Creating a process from a recently created file
Sending a custom TCP request
Creating a file in the %temp% directory
Gathering data
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/f156a7b27a367a54d8adedb7fd7675faab13d6d39de4f2c8c638bd049bd588d0
Verdict:
Malicious
File Type:
msi
Link:
https://opentip.kaspersky.com/f156a7b27a367a54d8adedb7fd7675faab13d6d39de4f2c8c638bd049bd588d0/results?tab=lookup
Result
Threat name:
SnappyClient
Create hunting rule
Detection:
malicious
Classification:
expl.evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2002181
Behaviour
Behavior Graph:
n/a
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:LZX Executable Office Document PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) T1059.007
Link:
https://app.malva.re/file/98d7ff70fcaa81b43ccf72317fa74f22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f156a7b27a367a54d8adedb7fd7675faab13d6d39de4f2c8c638bd049bd588d0/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6flkpmt2gz5fjwfn5w3725tv7kvrhvwttxspfsgghc6qjg6vrdia._file
Verdict:
malicious
Label(s):
SIDEEYE
Create hunting rule
Link:
https://reports.threatray.com/71f76a17-2d24-4045-8912-42bdd089bc6c
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader loader persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261109-y432fsvvdt/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Malware Family:
n/a
Verdict:
Malicious
Tags:
injector stealer
YARA:
n/a
Link:
https://app.threat.zone/submission/67ec6e48-349b-4bd3-9503-23a57a8de240
Malware Family:
abrisk
Create hunting rule
Malicious:
True
Tags:
persistence obfuscated msi usb-check
Link:
https://intel.virussign.com/intelligence/file/f156a7b27a367a54d8adedb7fd7675faab13d6d39de4f2c8c638bd049bd588d0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f156a7b27a367a54d8adedb7fd7675faab13d6d39de4f2c8c638bd049bd588d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98835/

Comments