MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb71f48345e3568b7e7ba1eb5078b055b7350673a92379dba231fd66dbd9dadc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb71f48345e3568b7e7ba1eb5078b055b7350673a92379dba231fd66dbd9dadc
SHA3-384 hash:	5e984991171bf15d1099cf17c9ca40a263e4ebf18145a6b605bb1935796adebac81edbc761a8607612d11fb3b5796c13
SHA1 hash:	fac812b468705d1376d86772664c08bef2983d17
MD5 hash:	f1a81262cef067c447ff20ef3c5f22fc
humanhash:	massachusetts-mango-three-aspen
File name:	fb71f48345e3568b7e7ba1eb5078b055b7350673a92379dba231fd66dbd9dadc
Download:	download sample
Signature	Casbaneiro Alert Create hunting rule
File size:	17'158'144 bytes
First seen:	2026-09-25 20:04:55 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	393216:JnMbmnGkQgK1YTEtX36PuXnOsN8LVyLeamuu8WsOLE:JUmn3QnYTEtHlnpN88ND
TLSH	T12807333FFC50CF8BFE06D4F51CE1D0D595AAAD70A732842B79B47196C03396826B9249
TrID	83.7% (.MSI) Microsoft Windows Installer (454500/1/170) 11.2% (.MST) Windows SDK Setup Transform script (61000/1/5) 3.5% (.WPS) Kingsoft WPS Office document (alt.) (19502/3/2) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	johnk3r
Tags:	casbaneiro empautlipa-com msi

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

BR

Vendor Threat Intelligence

ACCE MSI_FileType

Malware configuration found for:

AutoIt MSI

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e1fd4e52-db41-4d2a-a7b7-ab874dc10036/

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/89042/

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ace1fe6853d431abd4e09f1

Tags:

n/a

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

installer

Link:

https://www.filescan.io/uploads/6ab6d40db231515463a02bca/reports/784ad767-1673-4b14-84df-387ba24f280d/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/fb71f48345e3568b7e7ba1eb5078b055b7350673a92379dba231fd66dbd9dadc

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

msi

First seen:

2025-11-11T12:00:00Z UTC

Last seen:

2026-02-16T23:28:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fb71f48345e3568b7e7ba1eb5078b055b7350673a92379dba231fd66dbd9dadc/results?tab=lookup

Joe Sandbox Brazilian Banker

Result

Threat name:

Brazilian Banker

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

57 / 100

Link:

https://www.joesandbox.com/analysis/1812238

Signature

Creates autostart registry keys with suspicious values (likely registry only malware)

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Sigma detected: Register Wscript In Run Key

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected Brazilian Banker

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

49%

Verdict:

Susipicious

File Type:

ARCHIVE

Link:

https://malprob.io/report/fb71f48345e3568b7e7ba1eb5078b055b7350673a92379dba231fd66dbd9dadc

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

CAB:COMPRESSION:MSZIP Office Document

Link:

https://app.malva.re/file/f1a81262cef067c447ff20ef3c5f22fc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb71f48345e3568b7e7ba1eb5078b055b7350673a92379dba231fd66dbd9dadc/

ReversingLabs TitaniumCloud Win32.Spyware.Casbaneiro

Threat name:

Win32.Spyware.Casbaneiro

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-11 18:03:02 UTC

File Type:

Binary (Archive)

Extracted files:

39

AV detection:

20 of 36 (55.56%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ny7ja2f4nliw7t3uhvva6fqkw3tkbttverxtw5cgh6wnw6z3loa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260925-yt3b6swx2p/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes a VBScript file via the Windows Script Host.

Adds Run key to start application

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fb71f48345e3568b7e7ba1eb5078b055b7350673a92379dba231fd66dbd9dadc

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/89042/