MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504
SHA3-384 hash: 83ebc3a40071c6d8a45150b0acc042e3bd3da782ce416d3af3ee25a3dd635fbe4f7890e4e0080c4111e4156622fc68f1
SHA1 hash: 8df4d65102ceb1698993891ed741a7826d4f5820
MD5 hash: 9029828c1b614e4125b135444f164d16
humanhash: west-winner-march-table
File name:StoreInstaller.exe
Download: download sample
File size:1'276'128 bytes
First seen:2026-06-15 12:56:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'070 x AgentTesla, 20'026 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 12288:0LKKMLRtx66l+Tac0RDffXJjyYp2QoNHSy5viczRuWGu0g1Ga97pU+DgGfXJjy8J:q3Ml+2DR7BWYp2Qo44RuWf7rNBW8p3L
TLSH T11F455B8127FC0939F7B70B79BD7A18210A76BC396502E69E054D592D18F2F168DE233B
TrID 46.6% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
33.7% (.WINMD) Windows Runtime Metadata (53025/9/13)
4.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win64 Executable (generic) (6522/11/2)
3.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
dhash icon c4ccb392f1f192cc (4 x LummaStealer, 2 x AsyncRAT, 1 x Formbook)
Reporter SquiblydooBlog
Tags:exe signed

Code Signing Certificate

Organisation:REDPOINT SOFTWARE ANS
Issuer:Certum Extended Validation Code Signing 2021 CA
Algorithm:sha256WithRSAEncryption
Valid from:2026-04-16T16:08:48Z
Valid to:2027-04-16T16:08:47Z
Serial number: 37deece43a9618e6a1cf93f48fa1fd33
Thumbprint Algorithm:SHA256
Thumbprint: 8a9dbee48a92e121a46b41e3e7d9fa0b912e7ae414bcbfa59c74684106550e1e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504.exe
Verdict:
No threats detected
Analysis date:
2026-06-15 12:58:21 UTC
Tags:
qrcode
Link:
https://app.any.run/tasks/ef4f05a9-f8cf-48d7-a162-82a6dbb028e9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/70789/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2ff6b634eaf30d8ce6553a
Tags:
injection micro sage
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a service
DNS request
Connection attempt
Searching for synchronization primitives
Sending a custom TCP request
Sending an HTTP GET request
Changing a file
Launching a process
Creating a file
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504
Verdict:
Unknown
File Type:
exe x32
First seen:
2026-05-21T10:29:00Z UTC
Last seen:
2026-05-22T02:48:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/86d109ed-5883-4ff2-92ff-55206bf7ff57
Score:
16%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504
Threat name:
ByteCode-MSIL.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-05-21 19:30:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
128
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7uiw5n7hsg4at7xsmg4xbmbpzwskosep6mpvr44buhsnd5eyuuca._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery revoked_codesign
Link:
https://tria.ge/reports/260615-p64w4adz6m/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Checks computer location settings
Unpacked files
SH256 hash:
fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504
MD5 hash:
9029828c1b614e4125b135444f164d16
SHA1 hash:
8df4d65102ceb1698993891ed741a7826d4f5820
Link:
https://www.unpac.me/results/a1b69fa3-031b-404b-bbe5-608f78cfda34/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fd116eb7e791b809fef261b970b02fcda4a7488ff31f58f381a1e4d1f498a504

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:certum_issuer
Create hunting rule
Author:Certum
Description:Looks for files signed with certificate issued by Certum
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:detect_certum_issuer
Create hunting rule
Author:Certum
Description:Looks for files signed with certificate issued by Certum
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Runtime_Broker_Variant_1
Create hunting rule
Author:Sn0wFr0$t
Description:Detecting malicious Runtime Broker
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/70789/

Comments