Malicious
Strong tier-1 consensus and offensive MITRE techniques confirm this is a Blamon-family trojan.
f45dae4d83bf38a950…d3a659afb0The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
Tier-1 engines from Kaspersky, Microsoft, and others converge on Blamon and related trojan labels with a strong family consensus. The sample exhibits four offensive MITRE techniques and triggered high-severity heuristics for process injection and direct-IP command-and-control. Although the file is signed, the signer has no trusted-publisher match or historical safe-rate data, and prevalence is rare_new. Dropped children and sandbox verdicts are inconclusive but do not outweigh the engine and behavioural evidence.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1FamilyConsensus strong with 10 tier1Malicious engines (Kaspersky Trojan.Win32.Blamon.akhy, Microsoft Trojan:Win32/Sabsik)
offensiveTechniques T1055 T1485 T1548 T1562.001 plus direct contactedIps without domains
triggeredHeuristics MalwareTips.Synth.ProcessInjection and MalwareTips.Synth.DirectIpC2 both fired
popularThreatLabel trojan.blamon/filerepmalware with 22 malicious engines total
- No malicious dropped children detected
- No external YARA or CIRCL hits
- Process injection into svchost.exe
- Direct IP C2 without DNS resolution
- LSASS credential-store access
- Invalid signature on Bandisoft certificate
Treat as malicious and remove the file. Re-scan the host with updated definitions and monitor network traffic for the observed IPs.
blamon corroborated by 2 sources
- VT (75 engines)blamon
- MT AI Engineblamon
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 202.79.171.202
- 162.159.36.2
- C:\Users\<USER>\Desktop\resources.pri.back
- C:\Users\<USER>\Desktop\App.xbf.back
- C:\Users\<USER>\AppData\Roaming\instagram\icon instagram text 1.0.0\install\holder0.aiph
- C:\Users\<USER>\AppData\Roaming\instagram\icon instagram text 1.0.0\install\20AA6B5\icon instagram text.msi
- C:\Users\<USER>\AppData\Local\Temp\shiF906.tmp
- C:\Users\<USER>\Desktop\resources.pri
- C:\Users\<USER>\Desktop\App.xbf
- C:\Users\<USER>\AppData\Roaming\instagram\icon instagram text 1.0.0\install\holder0.aiph
- C:\Users\<USER>\AppData\Roaming\instagram\icon instagram text 1.0.0\install\20AA6B5\FILES.7z
- C:\Users\<USER>\AppData\Roaming\instagram\icon instagram text 1.0.0\install\20AA6B5
- Global\OneSettingQueryMutex+compat+encapsulation
- Local\SessionImmersiveColorMutex
- Global\_MSIExecute
- \Sessions\1\BaseNamedObjects\Advinst_248B46A4911A4894937E84237EB6084C
- \Sessions\1\BaseNamedObjects\3392_mdl_evt
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- afaaeb53ed2546030832…718402Never scannednever seen before
- bbeeaf2c7d9073ee09d3…a03c46Never scannednever seen before
- d38a927739fb3efa03e0…ee0f48Never scannednever seen before
- 13026df002b3575564f3…fef67cNever scannednever seen before
- b413f47d13ee2fe6c845…5bc8d2Never scannednever seen before
- 9f14255c71f9f59d6903…1a7178Never scannednever seen before
- 3835bd02c8f252236b41…eca7fdNever scannednever seen before
- 047e2df9ccf0ce298508…9d064bNever scannednever seen before
- e245c42ec59a1c5daca2…4b8473Never scannednever seen before
- 573c7a8c4c9c6f1b79df…8e9461Never scannednever seen before
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
EvidenceC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHostSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exeSample contacted 2 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence202.79.171.202 · 162.159.36.2
22 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.
Forensic fingerprint
- File name
- icon instagram text.exe
- Size
- 10.99 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- f45dae4d83bf38a9505999e3c049d5623d3b27137a15dd493b675dd3a659afb0
- MD5
- c75781d6ba7d05efe8a5f7c827275114
- SHA-1
- 19969b6fab9a77622e0bcc6486a82f41ad154bf5
- PE imphash
- 4b200e917ee33d8e56206c360a98a2d3
- First seen (VT)
- 5/8/2026, 12:10:55 AM
- Last analysis (VT)
- 5/10/2026, 12:39:23 PM
- First scan (MalwareTips)
- 5/18/2026, 2:29:07 PM
- Last scan (MalwareTips)
- 5/18/2026, 2:29:07 PM
- Code signer
- Bandisoft International Inc.invalid
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.