MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd20457f839bc91ee5f6faf45d4ceee8c9e6851631fbf8b9a7bf940dfdba45b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

EtherRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	fd20457f839bc91ee5f6faf45d4ceee8c9e6851631fbf8b9a7bf940dfdba45b0
SHA3-384 hash:	4a240d70ccad80c832527d4c0c6e755c401cfa22562e2b52dc3a0bd47f75bdf3ddb0c60750fa29daf023de3c5d166ba0
SHA1 hash:	228927e9ec82bc88ede4a9008719e992418d9863
MD5 hash:	85c86cbc7defb27d1c1c8038e42afd6a
humanhash:	cola-artist-earth-diet
File name:	Transwiz.msi
Download:	download sample
Signature	EtherRAT Create hunting rule
File size:	32'256 bytes
First seen:	2026-03-28 18:34:26 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	768:tMstihWa2x3UcnjFgjTrHgYFyeWMbC3WN/nq:dtihWxx3UGOTAYFyob4
TLSH	T101E27D46FA04D232C5421B31425FABE48F769C44DFA7215236EEB38C6D379D065BB9E0
TrID	86.8% (.MSI) Microsoft Windows Installer (454500/1/170) 11.6% (.MST) Windows SDK Setup Transform script (61000/1/5) 1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	unknown
Reporter	l3fdb33f
Tags:	EtherRAT msi

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSI

Details

MSI

an embedded setup program or component

Link:

https://research.acce.ciphertechsolutions.com/results/5693dc15-a786-4526-a000-038f7aae43e9/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/59619/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69c81f6a635680513cf5117a

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

CAB installer obfuscated

Link:

https://www.filescan.io/uploads/69c81f6690759d6205bfb2aa/reports/a9b64e23-ace1-4864-93ce-bf0c7a042208/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fd20457f839bc91ee5f6faf45d4ceee8c9e6851631fbf8b9a7bf940dfdba45b0

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/fd20457f839bc91ee5f6faf45d4ceee8c9e6851631fbf8b9a7bf940dfdba45b0

Verdict:

Malicious

File Type:

msi

First seen:

2026-03-28T16:01:00Z UTC

Last seen:

2026-03-29T11:52:00Z UTC

Hits:

~10

Detections:

Backdoor.JS.Agent.ogv

Link:

https://opentip.kaspersky.com/fd20457f839bc91ee5f6faf45d4ceee8c9e6851631fbf8b9a7bf940dfdba45b0/results?tab=lookup

Score:

63%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

execution persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260328-w8gmxabw9l/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

Drops file in Windows directory

Adds Run key to start application

Enumerates connected drives

Looks up external IP address via web service

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd20457f839bc91ee5f6faf45d4ceee8c9e6851631fbf8b9a7bf940dfdba45b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.