MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4
SHA3-384 hash: 414bcbb2e63982aaf377b3d770abee50c6053c3bcce9032005446e4373cd74b6338726478289f44b0ce8e55d1ce33690
SHA1 hash: 1861526acc42bde948c5f01649ba6b7c4bf3f07a
MD5 hash: c280b597dd2ada5c78d39bb6a2809632
humanhash: shade-washington-hotel-utah
File name:Uso_Exclusivo_Interno_99.img
Download: download sample
File size:6'121'472 bytes
First seen:2026-07-30 12:27:07 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 98304:91HuUcIzAjbncF+4f+0UuIjOH7tUejyb+c3hKYd9:tczbc04GkISH5Bjs+cwY
TLSH T1F2560117F6A240DDC5AFC534C39A9773AA30B46D13247E1E6E68DB322F50D50AB2EB14
TrID 88.5% (.NULL) null bytes (2048000/1)
11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.1% (.ISO) ISO 9660 CD image (2545/36/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika iso
Reporter proxylife
Tags:img

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
DE DE
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:libvlc.dll
File size:4'815'707 bytes
SHA256 hash: bf945125454667e45f5817b898b20d82ba7952f8e9f053dbb7c546586cc0ed42
MD5 hash: e2b99d224f6fe1c7895883632d456ab4
MIME type:application/x-dosexec
File name:Uso_Exclusivo_Interno.pdf.lnk
File size:1'861 bytes
SHA256 hash: ea15a28347c3e88e77cf45c72d4837355799d324736677a224242e51f954760c
MD5 hash: 7ccf316b77f27ef40e26874f6141b35b
MIME type:application/octet-stream
File name:libvlc_original.dll
File size:192'408 bytes
SHA256 hash: 8ae9f16a72441f43fb4ae8f72c843736726e067ea4a8def2646748631cc4e872
MD5 hash: cbfbca59dd83388486cb52fffce2ccb0
MIME type:application/x-dosexec
File name:vlc.exe
File size:1'046'424 bytes
SHA256 hash: bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 hash: f0a4d5c3492115bfe2f346bc7bdce396
MIME type:application/x-dosexec
Vendor Threat Intelligence
Malware configuration found for:
Archives LNK
Details
Link:
https://research.acce.ciphertechsolutions.com/results/939647ca-d89a-4724-a13d-79841875c633/
Detection(s):
SecuriteInfo.com.Heur.2754.20508.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.FireForYou.20221018.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.FireForYou.20221027.UNOFFICIAL
Create hunting rule

TwinWave.EviLNK.PolicyKillXLACreepin.20230609.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADaypshell.20231121.UNOFFICIAL
Create hunting rule

Sanesecurity.Foxhole.Iso_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27118.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.20221214.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Threat level:
n/a  -.1.0/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm crypto mingw overlay packed reconnaissance signed
Link:
https://www.filescan.io/uploads/6a6b4331712124083615be01/reports/1021f06f-b05b-49b8-8a13-262a348b2c1c/overview
Verdict:
Suspicious
Labled as:
Mal/DrodIso
Link:
https://www.hybrid-analysis.com/sample/08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4
Verdict:
Malicious
File Type:
unknown
First seen:
2026-07-30T11:04:00Z UTC
Last seen:
2026-08-01T09:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4/results?tab=lookup
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-30 12:28:34 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbtg3x6izcy2teazcsrmhobyrwrq75js4wmmralj7rbo4l7dzdka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:iso_lnk
Create hunting rule
Author:tdawg
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments